Security context

Highlights

Auth Bypass: 7 prior fixes. Scrutinize any change in this area.

flask_cors/core.py: most-fixed (8 issues). Treat as high-risk during review.

5 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

Auth Bypass: Misconfigured sorting logic in parse_resources historically caused less specific wildcard path patterns to shadow more specific path rules, resulting in authorization bypasses. Similarly, case-insensitivity issues during request-path evaluation let unauthorized origins access restricted resources.

Auth Bypass: Inconsistent URL path decoding during match operations allowed bypasses of path-restricted CORS rules. Specifically, using unquote_plus instead of unquote erroneously translated literal '+' signs into space characters, altering the intended resource evaluation context.

CORS Misconfiguration: Allowing private network access headers by default exposed local and private network endpoints to public internet origins. Restricting the setting to false by default prevents unauthorized cross-origin connections to internal corporate or loopback resources.