🛡️ Sentinel: [MEDIUM] Fix hardcoded CORS Allowed Origins - #491
🛡️ Sentinel: [MEDIUM] Fix hardcoded CORS Allowed Origins#491seonghobae wants to merge 2 commits into
Conversation
The hardcoded static array of localhost URLs in the FastAPI CORS middleware violates operational security by preventing the application from safely deploying to external production environments without opening up or recompiling the app. This change introduces `ALLOWED_CORS_ORIGINS` to `core.config` and updates `CORSMiddleware` in `main.py` to dynamically parse it.
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
|
Warning Review limit reached
More reviews will be available in 8 minutes and 12 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more credits in the billing tab to continue. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (3)
📝 WalkthroughWalkthroughThis PR externalizes CORS origin configuration from hardcoded values in the FastAPI middleware to a configurable ChangesCORS Configuration Externalization
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes Poem
🚥 Pre-merge checks | ✅ 4✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Warning Billing warning: we have not been able to collect payment for this subscription for more than 72 hours. Please update the payment method or pay any pending invoices in Billing to avoid service interruption. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
PR governance metadata gate is not ready for
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@backend/core/config.py`:
- Line 26: Validate and normalize ALLOWED_CORS_ORIGINS at settings load instead
of passing the raw comma string to CORSMiddleware: parse the comma-separated
value in config.py into a list (e.g., settings.ALLOWED_CORS_ORIGINS_LIST), trim
entries, reject any entry equal to "*" or containing wildcards like "*." or
containing non-http(s) schemes, and for each entry use urlparse to ensure scheme
is "http" or "https", netloc is present, and path/query/fragment are empty; on
any failure raise a ValueError with a clear message so the app fails fast.
Update code that currently calls settings.ALLOWED_CORS_ORIGINS.split(",") (e.g.,
in main.py where CORSMiddleware is configured) to use the validated list
(settings.ALLOWED_CORS_ORIGINS_LIST) instead. Ensure the validation logic
references ALLOWED_CORS_ORIGINS and produces the normalized list for downstream
use.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 3b6b05bb-3923-4855-a1c9-5ba22f1a4957
📒 Files selected for processing (2)
backend/core/config.pybackend/main.py
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
OpenCode Agent requested changes because GitHub Checks failed on the current head.
- Result: REQUEST_CHANGES
- Reason: one or more GitHub Checks failed on current head
64731776b46f28151be87c14a7a54d4b6c0bf402. - Head SHA:
64731776b46f28151be87c14a7a54d4b6c0bf402 - Workflow run: 27449167051
- Workflow attempt: 1
Failed checks:
- Strix Security Scan/strix workflow run: cancelled (https://github.com/Seongho-Bae/naruon/actions/runs/27449166433)
Line-specific fallback findings:
No deterministic missing-string markers were recognized. Use the failed-check evidence below to map each failed check to exact local source lines before approving.
Failed check evidence for line-specific fixes:
Failed GitHub Check Evidence
- PR: #491
- Head SHA:
64731776b46f28151be87c14a7a54d4b6c0bf402 - Repository:
Seongho-Bae/naruon
Line-specific repair contract
-
Treat the check logs and annotations below as diagnostic evidence, not as a complete review.
-
For each actionable failed check, inspect the local source or diff and identify the exact file line that must change.
-
OpenCode
REQUEST_CHANGESfindings must includepath,line,root_cause,fix_direction,regression_test_direction, andsuggested_diff. -
Do not request changes with only a GitHub Actions URL or a generic check name.
-
When Strix logs contain multiple
Vulnerability ReportorModel ... Vulnerabilities ...sections, include every model-reported vulnerability in the review evidence and findings.
Failed check: Strix Security Scan
- Type:
workflow_run - Conclusion:
cancelled - Details URL: https://github.com/Seongho-Bae/naruon/actions/runs/27449166433
- Workflow run id:
27449166433
Failed workflow run log excerpt
OpenCode Review Overview
OpenCode Agent requested changes because GitHub Checks failed on the current head.
Failed checks:
Line-specific fallback findings: No deterministic missing-string markers were recognized. Use the failed-check evidence below to map each failed check to exact local source lines before approving. Failed check evidence for line-specific fixes: Failed GitHub Check Evidence
Line-specific repair contract
Failed check: Strix Security Scan
Failed workflow run log excerpt |
|
Superseded by #500. The actionable CORS origin validation requested here was carried into #500 in commit 9d48b7f (backend/core/config.py, backend/main.py, backend/tests/test_config.py). Local verification on that branch passed: PYTHONPATH=backend python -m pytest backend/tests/test_config.py; python -m py_compile backend/core/config.py backend/main.py backend/tests/test_config.py; git diff --check. The remaining #491 blocker was Strix/OpenCode evidence for a cancelled Strix workflow run, not an additional code finding. |
Understood. Acknowledging that this work is superseded by #500 and stopping work on this task. |
1 participant
🛡️ Sentinel: [MEDIUM] Fix hardcoded CORS Allowed Origins
🚨 Severity: MEDIUM
💡 Vulnerability: The
CORSMiddlewarein FastAPI was initialized with a static array of allowed origins for localhost (http://localhost:3000, etc.). This means the application's CORS policy could not be scoped dynamically per environment or domain without changing the code.🎯 Impact: Prevents safe and granular deployment to external production environments because CORS cannot be correctly configured per-environment; it is either stuck on localhost or must be dangerously opened entirely (
*).🔧 Fix: Added
ALLOWED_CORS_ORIGINStobackend/core/config.pyand modifiedCORSMiddlewareinbackend/main.pyto dynamically parse it.✅ Verification: Backend unit tests pass. Locally tested that the default string behavior matches prior static behavior.
PR created automatically by Jules for task 5029025895504333542 started by @seonghobae
Summary by CodeRabbit