Repository navigation

security: scope CORS to loopback + block cross-origin config/stop (PER-8600/8601/8602/8603) - #2282

Merged

Shivanshu-07 merged 7 commits into

security/PER-8600-8603-server-origin-hardening

Jul 16, 2026

Merged

security: scope CORS to loopback + block cross-origin config/stop (PER-8600/8601/8602/8603)#2282
Shivanshu-07 merged 7 commits into
masterfrom
security/PER-8600-8603-server-origin-hardening

Commits on Jun 29, 2026
- security: scope CORS to loopback + block cross-origin config/stop (PER-8600/8601/8602/8603)
  
  Shivanshu-07
  and
  claude
  committed
  c9ef2d5
- test: update CORS preflight spec for loopback-scoped origins; drop dead [::1] branch
  
  Shivanshu-07
  and
  claude
  committed
  a3e54d0
- test(core): cover isLoopbackOrigin including the malformed-origin catch branch
  
  Shivanshu-07
  and
  claude
  committed
  69036bf
- fix(core): treat [::1] IPv6 literal as loopback origin (PER-8600)
  
  Shivanshu-07
  and
  claude
  committed
  c012ddd
Commits on Jul 8, 2026
- chore(core): suppress false-positive CORS Semgrep finding
  
  Shivanshu-07
  and
  claude
  committed
  b2668d7
Commits on Jul 9, 2026
- fix(core): make /percy/stop POST-only to close no-Origin GET CSRF bypass
  
  Shivanshu-07
  and
  claude
  committed
  2ffd545
Commits on Jul 13, 2026
- fix(core): gate all state-changing endpoints cross-origin at one choke point
  
  Shivanshu-07
  and
  claude
  committed
  82f4f0e