freeman 0cfb292cef fix(api): disable CORS credentials for wildcard origins ...

ALLOWED_HOSTS defaults to ["*"] and the CORS middleware always set
allow_credentials=True. Starlette echoes any request Origin with
Access-Control-Allow-Credentials in that combination, which lets every
site make credentialed cross-origin calls. resolve_cors_policy now
returns credentials=False for wildcard origins and keeps credentials
only when explicit origins are configured.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

2026-10-09 11:39:12 +08:00

..

adapters

fix(agent): reap macOS kernels before retrying group termination

2026-10-06 03:05:16 +08:00

agent

fix(agent): inject host dependencies into protocol factories

2026-10-08 13:43:59 +08:00

api

feat(music): preserve per-task CUE recognition policy

2026-10-08 08:51:01 +08:00

application

feat(music): optionally simplify written lyrics

2026-10-08 18:40:16 +08:00

chain

fix(subscribe): validate TMDB conversion and sync architecture facts

2026-10-08 21:22:17 +08:00

db

feat(search): 订阅补全逐页搜索、断点续搜与资源页手动分页 (#6907)

2026-10-07 14:40:55 +08:00

doctor

…

domain

feat(search): 订阅补全逐页搜索、断点续搜与资源页手动分页 (#6907)

2026-10-07 14:40:55 +08:00

foundation

…

locales

…

modules

feat(indexer): 适配 Milkie 站点搜索与连通测试

2026-10-08 17:18:10 +08:00

monitor

…

plugins

…

runtime

fix(api): disable CORS credentials for wildcard origins

2026-10-09 11:39:12 +08:00

scheduler

…

schemas

feat(music): preserve per-task CUE recognition policy

2026-10-08 08:51:01 +08:00

sdk

…

startup

feat(music): optionally simplify written lyrics

2026-10-08 18:40:16 +08:00

testing

…

workflow

…

__init__.py

…

cli.py

…

command.py

…

factory.py

fix(api): disable CORS credentials for wildcard origins

2026-10-09 11:39:12 +08:00

main.py

…