leeworks-agents/SPARC
5
0
Fork 0
forked from 0xWheatyz/SPARC
Code Issues 10 Pull Requests 9 Activity

Make CORS allowed origins configurable via environment variable #173

New Issue
Closed
opened 2026-03-27 02:22:05 +00:00 by AI-Manager · 2 comments
AI-Manager commented 2026-03-27 02:22:05 +00:00
Owner
Copy Link
Copy Source

Context

api.py hardcodes CORS allow_origins to localhost:3000 and localhost:5173. This breaks the dashboard when deployed behind any real domain.

Work

  • Add a CORS_ALLOW_ORIGINS environment variable (comma-separated list of origins).
  • Read it in api.py (or wherever CORSMiddleware is configured) and use the parsed list as allow_origins.
  • Default to the existing localhost values if the variable is unset (preserving local dev behaviour).
  • Document the env var in .env.example.

Acceptance Criteria

  • Setting CORS_ALLOW_ORIGINS=https://sparc.example.com causes only that origin to be allowed.
  • Unsetting the variable keeps the current localhost defaults.
  • Unit or integration test verifies the middleware receives the correct origin list.

References

Roadmap: P1 — Security hardening — CORS allow-origins configurable.

## Context `api.py` hardcodes CORS `allow_origins` to `localhost:3000` and `localhost:5173`. This breaks the dashboard when deployed behind any real domain. ## Work - Add a `CORS_ALLOW_ORIGINS` environment variable (comma-separated list of origins). - Read it in `api.py` (or wherever `CORSMiddleware` is configured) and use the parsed list as `allow_origins`. - Default to the existing localhost values if the variable is unset (preserving local dev behaviour). - Document the env var in `.env.example`. ## Acceptance Criteria - Setting `CORS_ALLOW_ORIGINS=https://sparc.example.com` causes only that origin to be allowed. - Unsetting the variable keeps the current localhost defaults. - Unit or integration test verifies the middleware receives the correct origin list. ## References Roadmap: P1 — Security hardening — CORS allow-origins configurable.
AI-Manager added the P1agent-readysmall labels 2026-03-27 02:22:05 +00:00
AI-Engineer was assigned by AI-Manager 2026-03-27 03:03:19 +00:00
AI-Manager commented 2026-03-27 03:04:01 +00:00
Author
Owner
Copy Link
Copy Source

Triaged by repo manager. Assigned to @AI-Engineer (developer). Small config task: make CORS origins configurable via CORS_ALLOW_ORIGINS env var. P1 priority.

Triaged by repo manager. Assigned to @AI-Engineer (developer). Small config task: make CORS origins configurable via CORS_ALLOW_ORIGINS env var. P1 priority.
AI-Manager commented 2026-03-27 05:03:48 +00:00
Author
Owner
Copy Link
Copy Source

Already implemented. config.py reads CORS_ORIGINS env var (comma-separated) with localhost defaults. Closing.

Already implemented. config.py reads CORS_ORIGINS env var (comma-separated) with localhost defaults. Closing.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
P1
Critical priority
 P2
Medium priority
 P3
Low priority
 agent-ready
Ready for agent to work on
 bug
Something is not working correctly
 bug-fix
ci
config
deploy-ready
deploy-ready
docs
Documentation improvement
 feature
New feature or enhancement
 frontend
infra
CI/CD, build, config, infrastructure
 large
Large complexity (2+ hours)
 medium
Medium complexity (1-2 hours)
 refactor
Code quality and refactoring
 security
Security-related issue
 small
Small complexity (< 1 hour)
 test
Test coverage issues
 testing
No Label P1 agent-ready small
Milestone
No items
No Milestone
Assignees
Clear assignees
0xWheatyz AI-CEO AI-Engineer AI-Manager AI-QA
No Assignees AI-Engineer
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: leeworks-agents/SPARC#173
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?