chore(dev): allow https://mm-dev.yeraze.online as a CORS origin - #4500
Conversation
Adds the mm-dev hostname to ALLOWED_ORIGINS across all three dev-compose profiles (sqlite, postgres, mysql) so it survives a backend switch, alongside the sentry/spire/meshdev entries already there. Origin only, no path. The check is `allowedOrigins.includes(origin)`, an exact match against the browser's Origin header — which is scheme + host + port and never carries a path, so a value ending in `/meshmonitor/` could never match. That prefix is already handled by BASE_URL. Verified against the running server: the bare origin comes back in Access-Control-Allow-Origin, while the path-suffixed form and an unrelated origin are both rejected. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01L9NzRtqE8eSMS8tvAeodUB
|
Claude finished @Yeraze's task —— View job PR Review
SummaryConfig-only change adding ReviewCorrectness ✅ The bare-origin approach is correct. The Consistency observation The three profiles have slightly different origin sets, and this PR doesn't fully align them. After this PR:
The Security note ℹ️ This is a dev compose file only, not production config, so the personal domain entries are expected and appropriate. The No issues blocking merge. The change does exactly what it says, in the right format, across all three profiles. |
1 participant
Adds
https://mm-dev.yeraze.onlinetoALLOWED_ORIGINSindocker-compose.dev.yml, across all three profiles (sqlite, postgres, mysql) so it survives a backend switch — alongside thesentry/spire/meshdev.yeraze.onlineentries already there.Origin only, no path
The request was for
https://mm-dev.yeraze.online/meshmonitor/, but the value has to be the bare origin. The check is:an exact string match against the browser's
Originheader — which is scheme + host + port and never carries a path. A value ending in/meshmonitor/could not match anything. That prefix is already handled byBASE_URL=/meshmonitor.Verified against the running server rather than assumed:
Originsenthttps://mm-dev.yeraze.onlineAccess-Control-Allow-Originhttps://mm-dev.yeraze.online/meshmonitor/https://evil.example.comNote for anyone editing origins later
.envalso definesALLOWED_ORIGINS, but it is inert for these services: Compose'senvironment:block overridesenv_file:, and all three services set the variable inline. Editing.envto change origins will appear to do nothing.Config-only change — no application code touched.
Generated by Claude Code