diff --git a/.changeset/fifty-wings-sip.md b/.changeset/fifty-wings-sip.md new file mode 100644 index 0000000000..037b1c077a --- /dev/null +++ b/.changeset/fifty-wings-sip.md @@ -0,0 +1,5 @@ +--- +"gradio": minor +--- + +feat:Perform CORS validation when the request has a cookie diff --git a/gradio/route_utils.py b/gradio/route_utils.py index 18e4f2684b..d347cfb0b3 100644 --- a/gradio/route_utils.py +++ b/gradio/route_utils.py @@ -744,9 +744,8 @@ class CustomCORSMiddleware: message.setdefault("headers", []) headers = MutableHeaders(scope=message) headers.update(self.simple_headers) - has_cookie = "cookie" in request_headers origin = request_headers["Origin"] - if has_cookie or self.is_valid_origin(request_headers): + if self.is_valid_origin(request_headers): self.allow_explicit_origin(headers, origin) await send(message)