Merge pull request #58 from christianlouis/security-fix-cors-methods-15224374223607102322

🔒 Restrict overly permissive CORS allow_methods
2026-03-23 17:06:18 +01:00
parent 5e4633b481 0e770e92bf
commit 513b62fa6d
1 changed files with 1 additions and 1 deletions
@@ -66,7 +66,7 @@ def create_application() -> FastAPI:
        CORSMiddleware,
        allow_origins=settings.CORS_ORIGINS,
        allow_credentials=True,
-        allow_methods=["*"],
+        allow_methods=["GET", "POST", "PUT", "DELETE", "OPTIONS"],
        allow_headers=["*"],
    )