Skip to content
CC Switch WikiUnofficial Community Wiki

CORS Misconfiguration: Reported API credential abuse through the cc-switch local proxy

Quick fix

No verifiable fix is provided. Restricting CORS, removing the CORS layer, and adding a local token are reporter suggestions; no fixed version is evidenced.

Symptom

Section titled “Symptom”
Error output
[Security] CORS Misconfiguration in Local Proxy Enables 1-Click API Key Abuse

Cause

Section titled “Cause”

The reporter states that the cc-switch local proxy at 127.0.0.1:15721 uses allow_origin(Any) in src-tauri/src/proxy/server.rs and permits arbitrary methods and request headers. According to the report, websites can send cross-origin requests to the proxy, which automatically attaches the user's configured provider credentials. This could allow API calls using those credentials without knowing the API key.

The reported environment was macOS with cc-switch 3.12.3. The reporter claims earlier versions with proxy functionality are also affected but gives no starting version. The report also raises concerns about /health probing, /status information exposure, and missing proxy authentication and rate limiting. The issue is closed, but the supplied material contains no maintainer confirmation, fix commit, or verification results. The claim about sensitive context exfiltration also has no independent verification record.

Fix

Section titled “Fix”

  1. The report provides no verifiable fix. Check subsequent discussion in issue #1841 for a fix commit, fixed version, or verification results. A closed status does not establish that the issue is fixed.

  2. For maintainer evaluation: the reporter suggests restricting CORS origins to localhost, removing CorsLayer, or adding a local secret token to proxy requests. These are candidate fixes; the supplied material does not establish that they were implemented or verified as effective.

Affected Versions

Section titled “Affected Versions”
ToolUnknown
Version3.12.3（报告所称受影响版本；此前包含代理功能的版本也被报告涉及，起始版本未知）
PlatformsmacOS

Source Issues

Section titled “Source Issues”

This page is distilled from 1 real issues

FAQ

Section titled “FAQ”

(No FAQ yet)

Section titled “Related problems”
Prompt files are never rebuiltPrompt, live configuration, and caches are not fully rebuilt after database restoration. No verifiable fix is available; follow the merged discussion.1 issues mergedCC Switch flashes once when clicking any buttonOn Windows, use WebView2 152.0.4191.62 Fixed Version only for CC Switch to avoid click flashing with WebView2 153.0.4234.32.2 issues mergedcc-switch Usage Statistics Differ from DeepSeek Official Site / Stop UpdatingUpgrade to v3.19.2 or later, then run “Rebuild Codex Usage” once on the “Usage Statistics” page to correct historical overcounts or missing records.22 issues merged

This is an unofficial community wiki with no affiliation to the cc-switch authors or the project itself. Its content is compiled from the project's public GitHub issues. This site distributes no software.