prometheus / prometheus/alertmanager
Document the wildcard CORS default, and reconsider it for the v3 API
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 8.6k
- Forks
- 2.5k
- Avg merge
- 2d 6h
- Merged PRs (30d)
- 61
Description
By default Alertmanager responds with Access-Control-Allow-Origin: * on api/v2,.
This is partly known and is mentioned in the security model, so it is not a vulnerability report. It is a footgun with a questionable default. The current default also looks accidental in origin (#487, #1667) rather than deliberate.
Two things we would like to address:
- Docs: doc/https.md says nothing about CORS. Add a note there (and wherever we describe fronting Alertmanager with a proxy) explaining the wildcard default, what it exposes, and how to restrict it.
- v3 default: the v3 API is the natural point to stop shipping a disabled security feature as the default. The maintainers have to decide whether v3 should match v2 in this regard.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with doc/https.md and the existing security model guidance, then locate the documentation describing fronting Alertmanager with a proxy. Document the api/v2 wildcard CORS default, its exposure, and restriction options. The v3 API default requires a maintainer decision; done should include the agreed documentation and, if approved, the corresponding v3 behavior change.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- api, documentation, security
- Issue type
- Documentation
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100