ruvnet/ruflo · error

CORS: No origins configured, restricting to same-origin only

Error message

CORS: No origins configured, restricting to same-origin only

What it means

Warning in HttpTransport.setupMiddleware(): CORS is enabled but corsOrigins is empty/undefined, so the transport falls back to same-origin-only handling instead of a wildcard. This is the secure default; cross-origin clients will be rejected until origins are configured.

Source

Thrown at v3/@claude-flow/shared/src/mcp/transport/http.ts:222

    }
  }

  /**
   * Setup Express middleware
   */
  private setupMiddleware(): void {
    // Security headers
    this.app.use(helmet({
      contentSecurityPolicy: false, // Allow for flexibility
    }));

    // CORS - Secure defaults (no wildcard in production)
    if (this.config.corsEnabled !== false) {
      const allowedOrigins = this.config.corsOrigins;

      // SECURITY: Reject wildcard CORS in production unless explicitly configured
      if (!allowedOrigins || allowedOrigins.length === 0) {
        this.logger.warn('CORS: No origins configured, restricting to same-origin only');
      }

      this.app.use(cors({
        origin: (origin, callback) => {
          // Allow requests with no origin (same-origin, curl, etc.)
          if (!origin) {
            callback(null, true);
            return;
          }

          // Check against allowed origins
          if (allowedOrigins && allowedOrigins.length > 0) {
            if (allowedOrigins.includes(origin) || allowedOrigins.includes('*')) {
              callback(null, true);
            } else {
              callback(new Error(`CORS: Origin '${origin}' not allowed`));
            }
          } else {

View on GitHub (pinned to fa13ee4ad6)

Solutions

1. Configure allowed CORS origins explicitly if cross-origin browser clients must connect.

When it happens

Trigger: Thrown at v3/@claude-flow/shared/src/mcp/transport/http.ts:222 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ruvnet/ruflo@fa13ee4ad6 (2026-08-18). Data as JSON: /api/errors/ecf21bbc0190bf76. Report an issue: GitHub.