Mejora de seguridad

backend/app/main.py

@@ -87,8 +87,14 @@ if settings.is_production():
         "X-Correlation-ID",
     ]
 else:
-    cors_allow_methods = ["*"]
-    cors_allow_headers = ["*"]
+    cors_allow_methods = ["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"]
+    cors_allow_headers = [
+        "Authorization",
+        "Content-Type",
+        "X-Tenant-ID",
+        "X-Tenant-Slug",
+        "X-Correlation-ID",
+    ]
 
 app.add_middleware(
     CORSMiddleware,