From fa52affe98b0be9895dc28dbe0362dec51f4f17c Mon Sep 17 00:00:00 2001 From: Matthias Mair Date: Thu, 3 Sep 2026 05:09:17 +0200 Subject: [PATCH] feat: warn about unsafe CORS (#12773) * feat: warn about unsafe CORS * extend docs * fix defaults * bump api version --------- Co-authored-by: Oliver --- docs/docs/settings/error_codes.md | 9 +++++++++ src/backend/InvenTree/InvenTree/api.py | 3 +++ src/backend/InvenTree/InvenTree/api_version.py | 5 ++++- src/frontend/src/components/nav/Alerts.tsx | 7 +++++++ src/frontend/src/defaults/defaults.tsx | 3 ++- src/frontend/src/states/states.tsx | 3 +++ 6 files changed, 28 insertions(+), 2 deletions(-) diff --git a/docs/docs/settings/error_codes.md b/docs/docs/settings/error_codes.md index 120bbc5b56..e444125fdc 100644 --- a/docs/docs/settings/error_codes.md +++ b/docs/docs/settings/error_codes.md @@ -226,6 +226,15 @@ Use separate accounts for administrative tasks and regular usage to reduce risk. A process was interrupted by the user, likely by a keyboard interrupt. This might lead to issues with the process that was interrupted, as it might not have completed its task. This is especially relevant for processes that are not idempotent or that do not have a good rollback mechanism. +#### INVE-W16 +**CORS is set to allow all origins - Backend** + +The CORS settings are set to allow all origins. This might lead to security issues, as it allows any website to make requests to the InvenTree server. It is recommended to restrict the CORS settings to only allow trusted origins. + +CORS settings only affect user browsers that respect them. Setting them correctly is not a replacement for proper network segmentation (via firewalls, VPNs, proxies, etc.) and should be used in addition to them. + +Use the INVENTREE_CORS_ORIGIN_ALLOW_ALL and INVENTREE_CORS_ORIGIN_WHITELIST settings - see the [Server Access settings](../start/config.md#server-access). + ### INVE-I (InvenTree Information) Information — These are not errors but information messages. They might point out potential issues or just provide information. diff --git a/src/backend/InvenTree/InvenTree/api.py b/src/backend/InvenTree/InvenTree/api.py index 46590577dd..e738d62881 100644 --- a/src/backend/InvenTree/InvenTree/api.py +++ b/src/backend/InvenTree/InvenTree/api.py @@ -267,6 +267,8 @@ class InfoApiSerializer(serializers.Serializer): target = serializers.CharField(read_only=True, allow_null=True) django_admin = serializers.CharField(read_only=True) settings = SettingsSerializer(read_only=True, many=False) + """System state details that are mainly for warning purposes and do not require a hard API contract.""" + system_state = serializers.JSONField(read_only=True) class InfoView(APIView): @@ -337,6 +339,7 @@ class InfoView(APIView): 'LOGIN_ENABLE_PWD_FORGOT' ), }, + 'system_state': {'cors_allow_all': settings.CORS_ALLOW_ALL_ORIGINS}, } return JsonResponse(data) diff --git a/src/backend/InvenTree/InvenTree/api_version.py b/src/backend/InvenTree/InvenTree/api_version.py index 801922c937..004316634b 100644 --- a/src/backend/InvenTree/InvenTree/api_version.py +++ b/src/backend/InvenTree/InvenTree/api_version.py @@ -1,11 +1,14 @@ """InvenTree API version information.""" # InvenTree API version -INVENTREE_API_VERSION = 539 +INVENTREE_API_VERSION = 540 """Increment this API version number whenever there is a significant change to the API that any clients need to know about.""" INVENTREE_API_TEXT = """ +v540 -> 2026-09-04 : https://github.com/inventree/InvenTree/pull/12773 + - Adds a "system_state" field to the info endpoint for non-critical general system state information + v539 -> 2026-09-02 : https://github.com/inventree/InvenTree/pull/12723 - Adds search fields to AddressList, ContactList, UserList, GroupList, RuleSetList, and TokenListView API endpoints diff --git a/src/frontend/src/components/nav/Alerts.tsx b/src/frontend/src/components/nav/Alerts.tsx index b69f58e19c..3450233073 100644 --- a/src/frontend/src/components/nav/Alerts.tsx +++ b/src/frontend/src/components/nav/Alerts.tsx @@ -149,6 +149,13 @@ export function getAlerts( code: 'INVE-W8', message: t`There are pending database migrations.`, condition: n_migrations > 0 + }, + { + key: 'cors', + title: t`CORS Settings`, + code: 'INVE-W16', + message: t`CORS is set to allow all origins.`, + condition: server?.system_state?.cors_allow_all || false } ]; diff --git a/src/frontend/src/defaults/defaults.tsx b/src/frontend/src/defaults/defaults.tsx index b3aa22bca1..18596e1c74 100644 --- a/src/frontend/src/defaults/defaults.tsx +++ b/src/frontend/src/defaults/defaults.tsx @@ -21,7 +21,8 @@ export const emptyServerAPI = { default_locale: null, django_admin: null, settings: null, - customize: null + customize: null, + system_state: null }; export interface SiteMarkProps { diff --git a/src/frontend/src/states/states.tsx b/src/frontend/src/states/states.tsx index e83b347867..6f593eedd6 100644 --- a/src/frontend/src/states/states.tsx +++ b/src/frontend/src/states/states.tsx @@ -40,6 +40,9 @@ export interface ServerAPIProps { navbar_message: string; disable_theme_storage: boolean; }; + system_state: { + cors_allow_all: null | boolean; + } | null; } let pendingGlobalStatesFetch: Promise | null = null;