Default behaviour for --cors-origins

[laythea]

--cors-origins defaults to * instead of localhost.

This causes the average person to falsely assume that there is no potential opening into the server.

I know this has been changed to print a message eg:

"W srv llama_server: CORS is set to allow all origins ('*') and no API key is set
W srv llama_server: this can be a security risk (cross-origin attacks)"

But my question, to which I could not find an answer, is why this default setting has not been changed to default to secure eg "--cors-origin locahost". I must be missing something, because printing an insecure default setting, rather than fixing the default setting, must have been done for a reason?

Good software engineering practice dictates the default to be secure, with override capability, not vice versa.

Thanks in advance

[LeandroCustodio2002]

You're not missing anything weird, it's a backwards-compat call, and it's explained in the PR that added the flag: #25655 (server: add --cors-* options).

Why * is still the default

Before that PR, llama-server always sent Access-Control-Allow-Origin: * and there was no way to turn it off. The reasoning back then was that the endpoints were stateless and read-only and didn't expose anything sensitive by default. The only real risk was DoS, which isn't treated as a vulnerability under llama.cpp's security policy.

When the flags were added, they kept the relaxed profile as the default on purpose ("no breaking changes"), and added the startup warning instead. Lots of setups depend on it: browser frontends served from a different origin, extensions, local tools hitting the server from another port. Switching the default to localhost would silently break all of those.

Where it is secure by default

The thing that changed the threat model was --agent / built-in tools / MCP, because now the API can read and write files. For those, the default is already locked down. In common/arg.cpp:

if ((!params.server_tools.empty() || mcp_enabled) && !params.cors_origins_explicit) {
    LOG_WRN("server tools or MCP servers are enabled, using localhost as default CORS origin (change via --cors-origins)\n");
    params.cors_origins = "localhost";
}

So if you enable --tools, --agent or any MCP config and don't pass --cors-origins yourself, it falls back to localhost.

Also worth remembering: --host defaults to 127.0.0.1, so out of the box nothing on your network can reach the server directly. The CORS default only matters for web pages running in your browser that try to talk to your local server.

What to set, depending on your setup (roughly what the PR recommends):

# same machine only
llama-server -m model.gguf --cors-origins localhost

# exposed on your LAN, UI served from a known origin
llama-server -m model.gguf --host 0.0.0.0 --cors-origins http://192.168.1.50:8080

# public: always use an API key (and ideally a reverse proxy in front)
llama-server -m model.gguf --host 0.0.0.0 --api-key "$LLAMA_API_KEY"

If you don't use cookies/credentials with it, you can also add --no-cors-credentials. With * + credentials enabled (the default) the server echoes back whatever Origin it gets, as the help text for that flag says.

Everything can also be set through env vars (LLAMA_ARG_CORS_ORIGINS, LLAMA_ARG_CORS_CREDENTIALS), which is handy in Docker.

For what it's worth, there's an open PR to make loopback-only the default (#25606), so if you want the default changed, that's the place to add your 👍 / argument.

[laythea]

Thanks for your considered answer.