[claude] Platform.Bible extension forces CorsAllowAny — likely unnecessary, and risky once login lands

[Claude, autonomous]

The Platform.Bible lexicon extension launches FwLiteWeb with --FwLiteWeb:CorsAllowAny=true (main.ts). That opens the local API (http://localhost:29348, no auth) to every web origin. Once #2426 lands, that API holds the user's Lexbox tokens, so any page open in the user's browser can act as a confused deputy: read their identity/projects, trigger downloads/send-receive, or force a logout — all with the user's credentials.

It doesn't look like we need the flag at all. It's a dev-only holdover from the extension POC (#1003, commit message: "setup cors to allow all origins in development") that was never revisited. Neither of the extension's two API consumers is cross-origin:

• the extension host (main.ts) calls the API from Node, where CORS doesn't apply;
• the embedded FW Lite viewer is served from :29348, so its calls are same-origin.

CORS only ever gated foreign origins — i.e. exactly the attacker, nobody legitimate.

Verified (flag removed, running in Platform.Bible)

• Embedded viewer loads and lists entries normally (Browse → 1,464 words), zero CORS errors in the console.
• Cross-origin GET /api/auth/servers with a spoofed Origin no longer returns Access-Control-Allow-Origin; a cross-origin POST preflight is rejected (405, no CORS headers). With the flag it returned Access-Control-Allow-Origin: * for both.

Fix

One-line removal on branch pb-ext-drop-cors-allow-any (no PR yet). One thing still worth a look before merging: confirm nothing else (e.g. a future direct-from-webview API call) relies on allow-any. The standalone MiniLcm SDK zip (appsettings.sdk.json) legitimately keeps CORS on and is unaffected.

Start in platform.bible-extension/src/main.ts and inspect how FwLiteWeb is launched, then check whether the embedded viewer or extension host makes any cross-origin API calls. Done means removing the CorsAllowAny launch option without breaking the viewer, and confirming the reported same-origin behavior and rejected cross-origin requests.