From ee06d6cf3e9af71fe40d526fe9581bb8c2d4d051 Mon Sep 17 00:00:00 2001
From: dextmorgn <64375473+dextmorgn@users.noreply.github.com>
Date: Sat, 30 May 2026 18:49:44 +0200
Subject: [PATCH] fix(api): restrict CORS origins via ALLOWED_ORIGINS env

allow_origins was ["*"] together with allow_credentials=True, which is
both insecure and rejected by browsers for credentialed requests. Read a
comma-separated ALLOWED_ORIGINS env var instead, defaulting to the Vite
dev origin http://localhost:5173. Documented in .env.example.
---
 .env.example             | 2 ++
 flowsint-api/app/main.py | 8 +++++++-
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/.env.example b/.env.example
index cb62c8d9..2d6c1fe1 100644
--- a/.env.example
+++ b/.env.example
@@ -6,5 +6,7 @@ NEO4J_URI_BOLT=bolt://neo4j:7687
 NEO4J_USERNAME=neo4j
 NEO4J_PASSWORD=password
 VITE_API_URL=http://127.0.0.1:5001
+# Comma-separated CORS allowed origins. Defaults to http://localhost:5173 (Vite dev) when unset.
+ALLOWED_ORIGINS=http://localhost:5173
 DATABASE_URL=postgresql://flowsint:flowsint@localhost:5433/flowsint
 REDIS_URL=redis://redis:6379/0
diff --git a/flowsint-api/app/main.py b/flowsint-api/app/main.py
index 60c99215..e45875fe 100644
--- a/flowsint-api/app/main.py
+++ b/flowsint-api/app/main.py
@@ -1,3 +1,5 @@
+import os
+
 from fastapi import FastAPI
 from fastapi.middleware.cors import CORSMiddleware
 
@@ -16,8 +18,12 @@ from app.api.routes import types
 from app.api.routes import custom_types
 from app.api.routes import enricher_templates
 
+# Comma-separated list of allowed origins, e.g. "https://app.example.com,https://staging.example.com"
+# Falls back to localhost dev origin when unset. Never use "*" with allow_credentials=True.
 origins = [
-    "*",
+    o.strip()
+    for o in os.getenv("ALLOWED_ORIGINS", "http://localhost:5173").split(",")
+    if o.strip()
 ]