inventree/InvenTree
2
0
Fork 0
mirror of https://github.com/inventree/InvenTree.git synced 2026-09-09 22:30:17 +00:00
Code Activity

feat: warn about unsafe CORS (#12773)

Browse Source 
* feat: warn about unsafe CORS

* extend docs

* fix defaults

* bump api version

---------

Co-authored-by: Oliver <oliver.henry.walters@gmail.com>
This commit is contained in:
Matthias Mair
2026-09-03 13:09:17 +10:00
committed by GitHub
co-authored by Oliver
parent 9f8dfda18b
commit fa52affe98
6 changed files with 28 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/docs/settings/error_codes.md
+9
View File
@@ -226,6 +226,15 @@ Use separate accounts for administrative tasks and regular usage to reduce risk.
A process was interrupted by the user, likely by a keyboard interrupt. This might lead to issues with the process that was interrupted, as it might not have completed its task. This is especially relevant for processes that are not idempotent or that do not have a good rollback mechanism.
#### INVE-W16
**CORS is set to allow all origins - Backend**
The CORS settings are set to allow all origins. This might lead to security issues, as it allows any website to make requests to the InvenTree server. It is recommended to restrict the CORS settings to only allow trusted origins.
CORS settings only affect user browsers that respect them. Setting them correctly is not a replacement for proper network segmentation (via firewalls, VPNs, proxies, etc.) and should be used in addition to them.
Use the INVENTREE_CORS_ORIGIN_ALLOW_ALL and INVENTREE_CORS_ORIGIN_WHITELIST settings - see the [Server Access settings](../start/config.md#server-access).
### INVE-I (InvenTree Information)
Information — These are not errors but information messages. They might point out potential issues or just provide information.