From 8b0c76d46c1197f55b7cc11ca1cb45823d3667e2 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 18 Nov 2025 22:33:02 +0000 Subject: [PATCH] Fix CORS configuration to prevent startup error - Changed CORS_ORIGINS default from "*" to NEXT_FRONTEND_URL fallback - Wildcard "*" is incompatible with allow_credentials=True in FastAPI - Updated .env.example with warning about wildcard usage - Defaults now properly cascade: CORS_ORIGINS -> NEXT_FRONTEND_URL -> localhost:3000 --- surfsense_backend/.env.example | 6 ++++-- surfsense_backend/app/config/__init__.py | 5 +++-- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/surfsense_backend/.env.example b/surfsense_backend/.env.example index 467078219..f936208a3 100644 --- a/surfsense_backend/.env.example +++ b/surfsense_backend/.env.example @@ -32,8 +32,10 @@ AUTH_TYPE=LOCAL REGISTRATION_ENABLED=TRUE or FALSE # CORS Configuration (comma-separated list of allowed origins) -# Use * to allow all origins, or specify domains like: https://example.com,https://app.example.com -CORS_ORIGINS=* +# WARNING: Do not use "*" - it's incompatible with credentials and insecure for production +# Defaults to NEXT_FRONTEND_URL if not set +# Example: CORS_ORIGINS=https://example.com,https://app.example.com +# CORS_ORIGINS=http://localhost:3000 # Google OAuth Credentials (OPTIONAL - Required only for Gmail and Google Calendar connectors) GOOGLE_OAUTH_CLIENT_ID=your_google_client_id diff --git a/surfsense_backend/app/config/__init__.py b/surfsense_backend/app/config/__init__.py index df2744f4d..1fa9d3f33 100644 --- a/surfsense_backend/app/config/__init__.py +++ b/surfsense_backend/app/config/__init__.py @@ -136,8 +136,9 @@ class Config: REGISTRATION_ENABLED = os.getenv("REGISTRATION_ENABLED", "TRUE").upper() == "TRUE" # CORS Configuration - # Comma-separated list of allowed origins, defaults to all origins if not set - _cors_origins_str = os.getenv("CORS_ORIGINS", "*") + # Comma-separated list of allowed origins, defaults to frontend URL + # Note: Wildcard "*" is not allowed when allow_credentials=True + _cors_origins_str = os.getenv("CORS_ORIGINS", os.getenv("NEXT_FRONTEND_URL", "http://localhost:3000")) CORS_ORIGINS = [origin.strip() for origin in _cors_origins_str.split(",") if origin.strip()] # Google OAuth