{"action":"created","issue":{"url":"https://api.github.com/repos/elastic/elasticsearch/issues/11890","labels_url":"https://api.github.com/repos/elastic/elasticsearch/issues/11890/labels{/name}","comments_url":"https://api.github.com/repos/elastic/elasticsearch/issues/11890/comments","events_url":"https://api.github.com/repos/elastic/elasticsearch/issues/11890/events","html_url":"https://github.com/elastic/elasticsearch/pull/11890","id":91275969,"number":11890,"title":"change CORS allow origin default to allow no origins","user":{"login":"jaymode","id":4339958,"avatar_url":"https://avatars.githubusercontent.com/u/4339958?v=3","gravatar_id":"","url":"https://api.github.com/users/jaymode","html_url":"https://github.com/jaymode","followers_url":"https://api.github.com/users/jaymode/followers","following_url":"https://api.github.com/users/jaymode/following{/other_user}","gists_url":"https://api.github.com/users/jaymode/gists{/gist_id}","starred_url":"https://api.github.com/users/jaymode/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jaymode/subscriptions","organizations_url":"https://api.github.com/users/jaymode/orgs","repos_url":"https://api.github.com/users/jaymode/repos","events_url":"https://api.github.com/users/jaymode/events{/privacy}","received_events_url":"https://api.github.com/users/jaymode/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/elastic/elasticsearch/labels/:Settings","name":":Settings","color":"009800"},{"url":"https://api.github.com/repos/elastic/elasticsearch/labels/enhancement","name":"enhancement","color":"4a4ea8"},{"url":"https://api.github.com/repos/elastic/elasticsearch/labels/review","name":"review","color":"0052cc"},{"url":"https://api.github.com/repos/elastic/elasticsearch/labels/v2.0.0","name":"v2.0.0","color":"dddddd"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-06-26T15:14:22Z","updated_at":"2015-07-08T16:13:45Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/elastic/elasticsearch/pulls/11890","html_url":"https://github.com/elastic/elasticsearch/pull/11890","diff_url":"https://github.com/elastic/elasticsearch/pull/11890.diff","patch_url":"https://github.com/elastic/elasticsearch/pull/11890.patch"},"body":"Today, we disable CORS by default, but if a user simply enables CORS their instance of\r\nelasticsearch will allow cross origin requests from anywhere, as the default value for allowed\r\norigins is `*`.\r\n\r\nThis changes the default to be `null` so that no origins are allowed and the user must explicitly\r\nspecify the origins they wish to allow requests from. The documentation also mentions that there\r\nis a security risk in using `*` as the value.\r\n\r\nCloses #11169"},"comment":{"url":"https://api.github.com/repos/elastic/elasticsearch/issues/comments/119643394","html_url":"https://github.com/elastic/elasticsearch/pull/11890#issuecomment-119643394","issue_url":"https://api.github.com/repos/elastic/elasticsearch/issues/11890","id":119643394,"user":{"login":"jpountz","id":299848,"avatar_url":"https://avatars.githubusercontent.com/u/299848?v=3","gravatar_id":"","url":"https://api.github.com/users/jpountz","html_url":"https://github.com/jpountz","followers_url":"https://api.github.com/users/jpountz/followers","following_url":"https://api.github.com/users/jpountz/following{/other_user}","gists_url":"https://api.github.com/users/jpountz/gists{/gist_id}","starred_url":"https://api.github.com/users/jpountz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jpountz/subscriptions","organizations_url":"https://api.github.com/users/jpountz/orgs","repos_url":"https://api.github.com/users/jpountz/repos","events_url":"https://api.github.com/users/jpountz/events{/privacy}","received_events_url":"https://api.github.com/users/jpountz/received_events","type":"User","site_admin":false},"created_at":"2015-07-08T16:13:45Z","updated_at":"2015-07-08T16:13:45Z","body":"Should there be a note in the migration guide about this change?"}}