fix(CORS): do not add "*" as an allowed host

2026-05-14 21:26:04 +02:00
parent 093687ab89
commit 3d4de5cd8b
1 changed files with 3 additions and 1 deletions
--- a/backend/src/settings/cors.rs
+++ b/backend/src/settings/cors.rs
@@ -59,7 +59,9 @@ impl From<CorsSettings> for Cors {
        );
        let mut cors = Self::new();
        for origin in &val.allowed_origins {
-            cors = cors.allow_origin(origin);
+            if origin != "*" {
+                cors = cors.allow_origin(origin);
+            }
        }
        cors = cors.allow_methods(vec![
            Method::GET,