mirror of
https://github.com/reconurge/flowsint.git
synced 2026-07-15 21:23:01 -05:00
ee06d6cf3e
allow_origins was ["*"] together with allow_credentials=True, which is both insecure and rejected by browsers for credentialed requests. Read a comma-separated ALLOWED_ORIGINS env var instead, defaulting to the Vite dev origin http://localhost:5173. Documented in .env.example.
62 lines
2.2 KiB
Python
62 lines
2.2 KiB
Python
import os
|
|
|
|
from fastapi import FastAPI
|
|
from fastapi.middleware.cors import CORSMiddleware
|
|
|
|
# Routes to be included
|
|
from app.api.routes import auth
|
|
from app.api.routes import investigations
|
|
from app.api.routes import sketches
|
|
from app.api.routes import enrichers
|
|
from app.api.routes import flows
|
|
from app.api.routes import events
|
|
from app.api.routes import analysis
|
|
from app.api.routes import chat
|
|
from app.api.routes import scan
|
|
from app.api.routes import keys
|
|
from app.api.routes import types
|
|
from app.api.routes import custom_types
|
|
from app.api.routes import enricher_templates
|
|
|
|
# Comma-separated list of allowed origins, e.g. "https://app.example.com,https://staging.example.com"
|
|
# Falls back to localhost dev origin when unset. Never use "*" with allow_credentials=True.
|
|
origins = [
|
|
o.strip()
|
|
for o in os.getenv("ALLOWED_ORIGINS", "http://localhost:5173").split(",")
|
|
if o.strip()
|
|
]
|
|
|
|
|
|
app = FastAPI(ignore_trailing_slash=True, redirect_slashes=False)
|
|
|
|
app.add_middleware(
|
|
CORSMiddleware,
|
|
allow_origins=origins,
|
|
allow_credentials=True,
|
|
allow_methods=["*"],
|
|
allow_headers=["*"],
|
|
)
|
|
|
|
|
|
@app.get("/health")
|
|
async def health():
|
|
"""Health check endpoint for Docker healthcheck"""
|
|
return {"status": "ok"}
|
|
|
|
|
|
app.include_router(auth.router, prefix="/api/auth", tags=["auth"])
|
|
app.include_router(sketches.router, prefix="/api/sketches", tags=["sketches"])
|
|
app.include_router(
|
|
investigations.router, prefix="/api/investigations", tags=["investigations"]
|
|
)
|
|
app.include_router(enrichers.router, prefix="/api/enrichers", tags=["enrichers"])
|
|
app.include_router(flows.router, prefix="/api/flows", tags=["flows"])
|
|
app.include_router(events.router, prefix="/api/events", tags=["events"])
|
|
app.include_router(analysis.router, prefix="/api/analyses", tags=["analyses"])
|
|
app.include_router(chat.router, prefix="/api/chats", tags=["chats"])
|
|
app.include_router(scan.router, prefix="/api/scans", tags=["scans"])
|
|
app.include_router(keys.router, prefix="/api/keys", tags=["keys"])
|
|
app.include_router(types.router, prefix="/api/types", tags=["types"])
|
|
app.include_router(custom_types.router, prefix="/api/custom-types", tags=["custom-types"])
|
|
app.include_router(enricher_templates.router, prefix="/api/enrichers/templates", tags=["enricher-templates"])
|