Currently, all available routes has CORS enabled, meaning that you can send requests to the API from anywhere. In the future, it might be a good idea to not allow this for admin routes to improve security.
Adonis allows for dynamic configuration of the CORS policy based on the request method. Disabling CORS for all POST, PUT and DELETE operation should do the trick (with some exceptions).
Currently, all available routes has CORS enabled, meaning that you can send requests to the API from anywhere. In the future, it might be a good idea to not allow this for admin routes to improve security.
Adonis allows for dynamic configuration of the CORS policy based on the request method. Disabling CORS for all
POST,PUTandDELETEoperation should do the trick (with some exceptions).