{"record":{"id":"ecf21bbc0190bf76","repo":"ruvnet/ruflo","slug":"cors-no-origins-configured-restricting-to-same-o","errorCode":null,"errorMessage":"CORS: No origins configured, restricting to same-origin only","messagePattern":"CORS: No origins configured, restricting to same-origin only","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"v3/@claude-flow/shared/src/mcp/transport/http.ts","lineNumber":222,"sourceCode":"    }\n  }\n\n  /**\n   * Setup Express middleware\n   */\n  private setupMiddleware(): void {\n    // Security headers\n    this.app.use(helmet({\n      contentSecurityPolicy: false, // Allow for flexibility\n    }));\n\n    // CORS - Secure defaults (no wildcard in production)\n    if (this.config.corsEnabled !== false) {\n      const allowedOrigins = this.config.corsOrigins;\n\n      // SECURITY: Reject wildcard CORS in production unless explicitly configured\n      if (!allowedOrigins || allowedOrigins.length === 0) {\n        this.logger.warn('CORS: No origins configured, restricting to same-origin only');\n      }\n\n      this.app.use(cors({\n        origin: (origin, callback) => {\n          // Allow requests with no origin (same-origin, curl, etc.)\n          if (!origin) {\n            callback(null, true);\n            return;\n          }\n\n          // Check against allowed origins\n          if (allowedOrigins && allowedOrigins.length > 0) {\n            if (allowedOrigins.includes(origin) || allowedOrigins.includes('*')) {\n              callback(null, true);\n            } else {\n              callback(new Error(`CORS: Origin '${origin}' not allowed`));\n            }\n          } else {","sourceCodeStart":204,"sourceCodeEnd":240,"githubUrl":"https://github.com/ruvnet/ruflo/blob/fa13ee4ad60ac2090b1480656eb233521790d640/v3/@claude-flow/shared/src/mcp/transport/http.ts#L204-L240","documentation":"Warning in HttpTransport.setupMiddleware(): CORS is enabled but corsOrigins is empty/undefined, so the transport falls back to same-origin-only handling instead of a wildcard. This is the secure default; cross-origin clients will be rejected until origins are configured.","triggerScenarios":"Thrown at v3/@claude-flow/shared/src/mcp/transport/http.ts:222 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Configure allowed CORS origins explicitly if cross-origin browser clients must connect."],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"fa13ee4ad60ac2090b1480656eb233521790d640","analyzedAt":"2026-08-18T21:34:22.708Z","contentChangedAt":"2026-08-18T21:34:22.708Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}