From 4541515682c01244d08522dd00ce64120e65f2cc Mon Sep 17 00:00:00 2001 From: Beinan Date: Sat, 25 Jul 2026 07:58:50 +0000 Subject: [PATCH] chore: remove permissive CORS from server and master Both binaries wrapped their routers in `CorsLayer::permissive()`, which sends `Access-Control-Allow-Origin: *` and allows any method and header. Combined with the absence of authentication, that instructs every browser to permit cross-origin calls from any page on the internet to endpoints that delete stores and mutate training data. Nothing needs it. The master serves its SPA itself (`fallback_service`) and the UI fetches a relative `/api/v1`, so admin traffic is same-origin in production; in development the vite proxy forwards `/api` to the master, so it is same-origin there too. No preflight is involved on either path. The data-plane server has no browser client at all. Drops the now-unused `cors` feature from both `tower-http` dependencies; the workspace builds clean, which confirms nothing else relied on it. A deployment that genuinely needs cross-origin access should opt in with an explicit allow-list of origins rather than a blanket wildcard. Co-Authored-By: Claude --- crates/lance-context-master/Cargo.toml | 2 +- crates/lance-context-master/src/main.rs | 4 +--- crates/lance-context-server/Cargo.toml | 2 +- crates/lance-context-server/src/main.rs | 4 +--- 4 files changed, 4 insertions(+), 8 deletions(-) diff --git a/crates/lance-context-master/Cargo.toml b/crates/lance-context-master/Cargo.toml index dcd2822..5ccfcf6 100644 --- a/crates/lance-context-master/Cargo.toml +++ b/crates/lance-context-master/Cargo.toml @@ -31,7 +31,7 @@ reqwest = { version = "0.12", default-features = false, features = ["json", "rus serde = { version = "1", features = ["derive"] } serde_json = "1" tokio = { version = "1", features = ["rt-multi-thread", "macros", "signal", "sync"] } -tower-http = { version = "0.6", features = ["cors", "fs", "trace"] } +tower-http = { version = "0.6", features = ["fs", "trace"] } tracing = "0.1" tracing-subscriber = { version = "0.3", features = ["env-filter"] } diff --git a/crates/lance-context-master/src/main.rs b/crates/lance-context-master/src/main.rs index a46a6c0..611adeb 100644 --- a/crates/lance-context-master/src/main.rs +++ b/crates/lance-context-master/src/main.rs @@ -1,7 +1,6 @@ use axum::Router; use clap::Parser; use tokio::net::TcpListener; -use tower_http::cors::CorsLayer; use tower_http::services::ServeDir; use tower_http::trace::TraceLayer; use tracing_subscriber::EnvFilter; @@ -66,8 +65,7 @@ async fn main() { .layer(axum::middleware::from_fn( lance_context_metrics::http_metrics_layer, )) - .layer(TraceLayer::new_for_http()) - .layer(CorsLayer::permissive()); + .layer(TraceLayer::new_for_http()); tracing::info!("Starting lance-context-master on {}", addr); diff --git a/crates/lance-context-server/Cargo.toml b/crates/lance-context-server/Cargo.toml index 3e62bf2..1a212c3 100644 --- a/crates/lance-context-server/Cargo.toml +++ b/crates/lance-context-server/Cargo.toml @@ -26,7 +26,7 @@ lru = "0.12" serde = { version = "1", features = ["derive"] } serde_json = "1" tokio = { version = "1", features = ["rt-multi-thread", "macros", "signal"] } -tower-http = { version = "0.6", features = ["cors", "trace"] } +tower-http = { version = "0.6", features = ["trace"] } tracing = "0.1" tracing-subscriber = { version = "0.3", features = ["env-filter"] } uuid = { version = "1", features = ["v4"] } diff --git a/crates/lance-context-server/src/main.rs b/crates/lance-context-server/src/main.rs index 0ba9f32..102567e 100644 --- a/crates/lance-context-server/src/main.rs +++ b/crates/lance-context-server/src/main.rs @@ -7,7 +7,6 @@ use std::sync::Arc; use clap::Parser; use tokio::net::TcpListener; -use tower_http::cors::CorsLayer; use tower_http::trace::TraceLayer; use tracing_subscriber::EnvFilter; @@ -74,8 +73,7 @@ async fn main() { .layer(axum::middleware::from_fn( lance_context_metrics::http_metrics_layer, )) - .layer(TraceLayer::new_for_http()) - .layer(CorsLayer::permissive()); + .layer(TraceLayer::new_for_http()); tracing::info!("Starting lance-context-server on {}", addr);