Overly Permissive CORS Policy

// bootstrap.utils.ts L134-L140
function initCors(app: NestExpressApplication): void {
  app.enableCors({
    origin: true,            // reflects ALL origins
    methods: "GET,HEAD,PUT,PATCH,POST,DELETE,OPTIONS",
    credentials: true,       // allows cookies cross-origin
  });
}

Frontend / on-chain mitigation analysis: CORS is a server-side policy, no frontend or on-chain control can mitigate this. The primary customer API authentication uses Authorization headers (not automatically attached cross-origin by browsers), reducing practical CSRF risk.

Cross-site request forgery and data exfiltration for cookie-authenticated endpoints. Practical impact is currently limited because the primary auth uses Authorization headers.

Replace origin: true with an explicit allowlist of trusted origins.

Fixed by infrastructure deletion in PR #3706, the dead session stack (express-session, cookie-parser, connect-redis) was removed entirely and CORS is now { origin: true, credentials: false }.