From ad1fbac16fc454e71a527856bce900486dabc23e Mon Sep 17 00:00:00 2001
From: behnam1990adel-hash <behnam1990adel-hash@users.noreply.github.com>
Date: Sat, 17 Oct 2026 01:04:05 +0330
Subject: [PATCH] fix(dev): default adk.web.cors.origins to the server's own
 loopback origins

Previously, when adk.web.cors.origins was left unset, CORS defaulted
to allowing every origin ("*"). Any website a developer's browser
visited while 'adk web' was running could call the local dev server
cross-origin: list loaded agents, create sessions, and drive full
agent execution with the agent's own configured tools and credentials.

This changes the default to the server's own loopback origins
(localhost / 127.0.0.1 / [::1] on the configured port) instead.
Setting adk.web.cors.origins explicitly still works exactly as
before, including the "*" opt-in with its existing warning.
---
 .../adk/web/config/AdkWebCorsConfig.java      | 43 ++++++++++++-------
 .../adk/web/config/AdkWebCorsProperties.java  |  5 ++-
 2 files changed, 31 insertions(+), 17 deletions(-)

diff --git a/dev/src/main/java/com/google/adk/web/config/AdkWebCorsConfig.java b/dev/src/main/java/com/google/adk/web/config/AdkWebCorsConfig.java
index 5e54f54cb..1e1c65c9f 100644
--- a/dev/src/main/java/com/google/adk/web/config/AdkWebCorsConfig.java
+++ b/dev/src/main/java/com/google/adk/web/config/AdkWebCorsConfig.java
@@ -16,8 +16,10 @@
 
 package com.google.adk.web.config;
 
+import java.util.List;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
+import org.springframework.beans.factory.annotation.Value;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.web.cors.CorsConfiguration;
@@ -30,35 +32,44 @@
  * application. This class defines beans for configuring CORS settings based on properties defined
  * in {@link AdkWebCorsProperties}.
  *
- * <p>CORS allows the application to handle requests from different origins, enabling secure
- * communication between the frontend and backend services.
- *
- * <p>Beans provided:
- *
- * <ul>
- *   <li>{@link CorsConfigurationSource}: Configures CORS settings such as allowed origins, methods,
- *       headers, credentials, and max age.
- *   <li>{@link CorsFilter}: Applies the CORS configuration to incoming requests.
- * </ul>
+ * <p>When no explicit origin allowlist is configured, this defaults to the server's own loopback
+ * origins (localhost / 127.0.0.1 / [::1] on the configured port) instead of allowing every origin,
+ * since allowing "*" by default lets any website a developer's browser visits call this server
+ * while it is running. Set 'adk.web.cors.origins' explicitly to widen this.
  */
 @Configuration
 public class AdkWebCorsConfig {
 
   private static final Logger logger = LoggerFactory.getLogger(AdkWebCorsConfig.class);
 
+  @Value("${server.port:8000}")
+  private int serverPort;
+
   @Bean
   public CorsConfigurationSource corsConfigurationSource(AdkWebCorsProperties corsProperties) {
-    if (corsProperties.origins().contains("*")) {
+    List<String> origins = corsProperties.origins();
+
+    if (origins.isEmpty()) {
+      origins =
+          List.of(
+              "http://localhost:" + serverPort,
+              "http://127.0.0.1:" + serverPort,
+              "http://[::1]:" + serverPort);
+      logger.info(
+          "No 'adk.web.cors.origins' configured; defaulting to this server's own loopback"
+              + " origins on port {}. Set 'adk.web.cors.origins' explicitly to allow other"
+              + " origins.",
+          serverPort);
+    } else if (origins.contains("*")) {
       logger.warn(
-          "CORS is configured to allow all origins (\"*\"), which is insecure and intended for"
-              + " local development only. This also applies to the /run_live WebSocket endpoint."
-              + " Set 'adk.web.cors.origins' to an explicit allowlist to restrict which origins"
-              + " may call the server.");
+          "CORS is configured to allow all origins (\"*\"), which is insecure and lets any"
+              + " website call this server, including the /run_live WebSocket endpoint. Only"
+              + " set this if you understand the risk.");
     }
 
     CorsConfiguration configuration = new CorsConfiguration();
 
-    configuration.setAllowedOrigins(corsProperties.origins());
+    configuration.setAllowedOrigins(origins);
     configuration.setAllowedMethods(corsProperties.methods());
     configuration.setAllowedHeaders(corsProperties.headers());
     configuration.setAllowCredentials(corsProperties.allowCredentials());
diff --git a/dev/src/main/java/com/google/adk/web/config/AdkWebCorsProperties.java b/dev/src/main/java/com/google/adk/web/config/AdkWebCorsProperties.java
index c96dce91e..c9688a8d1 100644
--- a/dev/src/main/java/com/google/adk/web/config/AdkWebCorsProperties.java
+++ b/dev/src/main/java/com/google/adk/web/config/AdkWebCorsProperties.java
@@ -34,7 +34,10 @@ public record AdkWebCorsProperties(
 
   public AdkWebCorsProperties {
     mapping = mapping != null ? mapping : "/**";
-    origins = origins != null && !origins.isEmpty() ? origins : List.of("*");
+    // Leave unset origins empty rather than defaulting to "*": AdkWebCorsConfig computes a
+    // same-machine loopback default from the server's own port when this is empty, so every
+    // origin on the internet is not allowed to call the server out of the box.
+    origins = origins != null ? origins : List.of();
     methods =
         methods != null && !methods.isEmpty()
             ? methods