Fix /sign-tx to allow source account credentials only for contract deployment#458
Fix /sign-tx to allow source account credentials only for contract deployment#458
/sign-tx to allow source account credentials only for contract deployment#458Conversation
There was a problem hiding this comment.
Pull request overview
This PR aims to fix missing CORS headers on error responses by replacing per-route CORS header setting with a global Express middleware intended to cover all responses (including errors) and handle OPTIONS preflight requests.
Changes:
- Added a global CORS middleware and OPTIONS preflight handling.
- Removed per-route CORS header setting from several routes.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
Preview is available here: |
JiahuiWho
force-pushed
the
add-global-cors-middleware
branch
from
3458834 to
f0f4ca1
Compare
|
Preview is available here: |
1 similar comment
|
Preview is available here: |
JiahuiWho
force-pushed
the
add-global-cors-middleware
branch
from
64cbb69 to
d03861c
Compare
|
Preview is available here: |
JiahuiWho
force-pushed
the
add-global-cors-middleware
branch
from
d03861c to
760b1de
Compare
JiahuiWho
changed the title
/sign-tx to allow source account credentials only for contract deployment
JiahuiWho
changed the title
/sign-tx to allow source account credentials only for contract deployment/sign-tx to allow source account credentials only for contract deployment
JiahuiWho
changed the title
/sign-tx to allow source account credentials only for contract deployment/sign-tx to allow source account credentials only for contract deployment
|
Preview is available here: |
JiahuiWho
force-pushed
the
add-global-cors-middleware
branch
from
760b1de to
70bc1f9
Compare
|
Preview is available here: |
marwen-abid
left a comment
marwen-abid
left a comment
There was a problem hiding this comment.
LGTM! Thank you for fixing this.
What's Changed
sorobanCredentialsSourceAccountauth entries, which blocked both the exploit and legitimate contract deployments. This PR refines the fix to inspect the authorized function: source account credentials are now only permitted for contract deployment (createContractV2HostFn) and rejected for everything else.Access-Control-Allow-Originheaders with a global Express middleware, ensuring all responses (including errors and preflight OPTIONS) include CORS headers.Context
Error responses were missing CORS headers, causing browsers to mask server errors s CORS failures.