From 5a7118622da85face80db212543cf7a0ec097310 Mon Sep 17 00:00:00 2001
From: divyanshujethi <divyanshujethi@gmail.com>
Date: Sun, 8 Nov 2026 00:45:43 +0530
Subject: [PATCH] security(cors): eliminate credential leak risk by avoiding
 wildcard with credentials

---
 src/proxy-server.ts | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/src/proxy-server.ts b/src/proxy-server.ts
index 80bfdd4..bdb789a 100644
--- a/src/proxy-server.ts
+++ b/src/proxy-server.ts
@@ -217,7 +217,7 @@ export class SkillPrismProxyServer {
             res.setHeader("Vary", "Origin");
           }
         } else {
-          res.setHeader("Access-Control-Allow-Origin", origin || "*");
+          res.setHeader("Access-Control-Allow-Origin", "*");
         }
 
         res.setHeader("Access-Control-Allow-Methods", "POST, GET, OPTIONS");
@@ -225,7 +225,6 @@ export class SkillPrismProxyServer {
           "Access-Control-Allow-Headers",
           "Content-Type, Authorization, mcp-session-id, x-session-id",
         );
-        res.setHeader("Access-Control-Allow-Credentials", "true");
 
         if (req.method === "OPTIONS") {
           res.writeHead(204);