From da72358475ef6c69fb81e487c7cb88dfbb6aa1ba Mon Sep 17 00:00:00 2001
From: Jayden Mapasure <mapasurejayden@gmail.com>
Date: Fri, 23 Oct 2026 08:46:44 +0200
Subject: [PATCH] security: disable credentialed CORS for wildcard origins

---
 app/main.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/app/main.py b/app/main.py
index a9ffff8..89798c0 100644
--- a/app/main.py
+++ b/app/main.py
@@ -45,8 +45,9 @@ async def lifespan(app: FastAPI):
 
 app.add_middleware(
     CORSMiddleware,
+    # Wildcard origins must not be combined with credentialed CORS responses.
     allow_origins=["*"],
-    allow_credentials=True,
+    allow_credentials=False,
     allow_methods=["*"],
     allow_headers=["*"],
 )