ferdi2go/OnlyFrames
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Security: CORS allow_headers enthält kein Authorization #2

New Issue
Closed
opened 2026-04-23 14:14:01 +02:00 by ferdi2go · 1 comment
ferdi2go commented 2026-04-23 14:14:01 +02:00
Owner
Copy Link
Copy Source

Problem\n\nserver.py:76 — allow_headers=["Content-Type"] fehlt Authorization.\n\nSobald die App über eine andere Origin aufgerufen wird (z.B. VCH-Subdomain-Wechsel), schlagen alle apiFetch()-Calls mit Bearer-Token still fehl — der Browser blockiert den CORS-Preflight.\n\n## Fix\n\npython\nallow_headers=["Content-Type", "Authorization"]\n

## Problem\n\n`server.py:76` — `allow_headers=["Content-Type"]` fehlt `Authorization`.\n\nSobald die App über eine andere Origin aufgerufen wird (z.B. VCH-Subdomain-Wechsel), schlagen alle `apiFetch()`-Calls mit Bearer-Token still fehl — der Browser blockiert den CORS-Preflight.\n\n## Fix\n\n```python\nallow_headers=["Content-Type", "Authorization"]\n```
ferdi2go added the priority: highsecurity labels 2026-04-23 14:14:01 +02:00
ferdi2go commented 2026-04-23 14:22:50 +02:00
Author
Owner
Copy Link
Copy Source

Fixed in commit be0a790.

Fixed in commit `be0a790`.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
maintenance
priority: high
priority: low
priority: medium
security
ux
No Label priority: high security
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
ferdi2go
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: ferdi2go/OnlyFrames#2
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?