From a9c2d37336cf4b1ff0d310ee7847f1923f5cbb9a Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Mon, 23 Mar 2026 14:36:57 +0000
Subject: [PATCH] Restrict overly permissive CORS allow_methods in
 backend/app/main.py.

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
---
 backend/app/main.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/backend/app/main.py b/backend/app/main.py
index c6b367d..882a400 100644
--- a/backend/app/main.py
+++ b/backend/app/main.py
@@ -66,7 +66,7 @@ def create_application() -> FastAPI:
         CORSMiddleware,
         allow_origins=settings.CORS_ORIGINS,
         allow_credentials=True,
-        allow_methods=["*"],
+        allow_methods=["GET", "POST", "PUT", "DELETE", "OPTIONS"],
         allow_headers=["*"],
     )