Tighten up cors settings

ooni · Sep 16, 2024 · 6450e68 · 6450e68
1 parent 981b9e2
commit 6450e68
Show file tree

Hide file tree

Showing 5 changed files with 5 additions and 13 deletions.
diff --git a/ooniapi/services/ooniauth/src/ooniauth/main.py b/ooniapi/services/ooniauth/src/ooniauth/main.py
@@ -38,11 +38,9 @@ async def lifespan(app: FastAPI):
     app, metric_namespace="ooniapi", metric_subsystem="ooniauth"
 )
 
-# TODO: temporarily enable all
-origins = ["*"]
 app.add_middleware(
     CORSMiddleware,
-    allow_origins=origins,
+    allow_origin_regex="^https://[-A-Za-z0-9]+(\.test)?\.ooni\.(org|io)$",
     allow_credentials=True,
     allow_methods=["*"],
     allow_headers=["*"],

diff --git a/ooniapi/services/oonifindings/src/oonifindings/main.py b/ooniapi/services/oonifindings/src/oonifindings/main.py
@@ -37,10 +37,9 @@ async def lifespan(app: FastAPI):
     app, metric_namespace="ooniapi", metric_subsystem="oonifindings"
 )
 
-# TODO: temporarily enable all
-origins = ["*"]
 app.add_middleware(
     CORSMiddleware,
+    allow_origin_regex="^https://[-A-Za-z0-9]+(\.test)?\.ooni\.(org|io)$",
     allow_origins=origins,
     allow_credentials=True,
     allow_methods=["*"],

diff --git a/ooniapi/services/oonimeasurements/src/oonimeasurements/main.py b/ooniapi/services/oonimeasurements/src/oonimeasurements/main.py
@@ -39,11 +39,9 @@ async def lifespan(app: FastAPI):
     app, metric_namespace="ooniapi", metric_subsystem="oonimeasurements"
 )
 
-# TODO: temporarily enable all
-origins = ["*"]
 app.add_middleware(
-    CORSMiddleware,
     allow_origins=origins,
+    allow_origin_regex="^https://[-A-Za-z0-9]+(\.test)?\.ooni\.(org|io)$",
     allow_credentials=True,
     allow_methods=["*"],
     allow_headers=["*"],

diff --git a/ooniapi/services/ooniprobe/src/ooniprobe/main.py b/ooniapi/services/ooniprobe/src/ooniprobe/main.py
@@ -37,10 +37,9 @@ async def lifespan(app: FastAPI):
     app, metric_namespace="ooniapi", metric_subsystem="ooniprobe"
 )
 
-# TODO: temporarily enable all
-origins = ["*"]
 app.add_middleware(
     CORSMiddleware,
+    allow_origin_regex="^https://[-A-Za-z0-9]+(\.test)?\.ooni\.(org|io)$",
     allow_origins=origins,
     allow_credentials=True,
     allow_methods=["*"],

diff --git a/ooniapi/services/oonirun/src/oonirun/main.py b/ooniapi/services/oonirun/src/oonirun/main.py
@@ -38,11 +38,9 @@ async def lifespan(app: FastAPI):
     app, metric_namespace="ooniapi", metric_subsystem="oonirun"
 )
 
-# TODO: temporarily enable all
-origins = ["*"]
 app.add_middleware(
     CORSMiddleware,
-    allow_origins=origins,
+    allow_origin_regex="^https://[-A-Za-z0-9]+(\.test)?\.ooni\.(org|io)$",
     allow_credentials=True,
     allow_methods=["*"],
     allow_headers=["*"],