CORS wildcard and public Prometheus metrics — LOW

[DQiash]

Description

The bridge API returns access-control-allow-origin: * for arbitrary origins and exposes a public Prometheus /metrics endpoint.

Affected component(s)

• bitvm-node — rpc_service/cors_config.rs (falls back to Any when CORS_ALLOWED_ORIGINS is unset/invalid) and the metrics endpoint
• Scope area: Bridge State Machine (API)

Steps to reproduce

1. Send a CORS preflight with Origin: http://evil.example.
2. Send a simple GET /v1/nodes.
3. GET /metrics.

Proof of concept

HTTP/1.1 200 OK
access-control-allow-methods: GET,POST,PUT,DELETE,OPTIONS
access-control-allow-headers: content-type,accept,origin,access-control-request-method,access-control-request-headers
access-control-allow-origin: *

bitvm_node_p2p_connected_peers 5
bitvm_node_p2p_required_topics_healthy ...

Security impact

Wildcard CORS lets any origin make credentialed cross-origin requests, and public metrics leak peer count, topic health, and operator/verifier request counters. Low severity, but worth tightening before mainnet.

---