Add CORS configuration allowing only the production frontend origin #103

New issue

Closed

opened 2026-04-08 18:44:19 -04:00 by pook · 12 comments

pook commented 2026-04-08 18:44:19 -04:00

Owner

Copy link

Without explicit CORS configuration, the API either blocks all cross-origin requests (breaking the frontend) or relies on a permissive default that allows any origin to call generation endpoints.

Implementation

• Add cors middleware with an allowlist of origins from environment variable ALLOWED_ORIGINS (comma-separated)
• Default to no origins allowed if env var is missing (fail-closed)
• Allow credentials for authenticated endpoints
• Restrict allowed methods to GET, POST, OPTIONS
• Add preflight caching (Access-Control-Max-Age: 86400)
• Unit test: allowed origin gets CORS headers, disallowed origin does not

Acceptance criteria

• Only allowlisted origins receive CORS headers
• OPTIONS preflight returns correct headers
• Missing ALLOWED_ORIGINS env var results in all cross-origin requests being blocked
• Tests cover allow and deny cases

---

Generated by CEO Planner (priority: 2)

Without explicit CORS configuration, the API either blocks all cross-origin requests (breaking the frontend) or relies on a permissive default that allows any origin to call generation endpoints. ## Implementation - Add cors middleware with an allowlist of origins from environment variable `ALLOWED_ORIGINS` (comma-separated) - Default to no origins allowed if env var is missing (fail-closed) - Allow credentials for authenticated endpoints - Restrict allowed methods to GET, POST, OPTIONS - Add preflight caching (Access-Control-Max-Age: 86400) - Unit test: allowed origin gets CORS headers, disallowed origin does not ## Acceptance criteria - Only allowlisted origins receive CORS headers - OPTIONS preflight returns correct headers - Missing ALLOWED_ORIGINS env var results in all cross-origin requests being blocked - Tests cover allow and deny cases --- *Generated by CEO Planner (priority: 2)*

pook added the

agent-task

label 2026-04-08 18:44:19 -04:00

pook referenced this issue 2026-04-08 21:51:49 -04:00

Close stale issues superseded by newer scoped issues — #37, #38, #39, #42, #53 #145

pook referenced this issue 2026-04-08 21:53:04 -04:00

Add CORS configuration and security headers middleware #39

pook referenced this issue 2026-04-08 21:53:15 -04:00

[Agent] Issue #145: multiple stale issues 11h are duplicates #146

pook commented 2026-04-09 00:50:13 -04:00

Author

Owner

Copy link

⚠️ Stale Task Alert — This task has been open for 6h with no associated PR.

Possible causes:

• Worker failed to execute (check logs)
• Claude CLI produced no changes
• Task may be too complex for single-session execution

The CEO planner will re-evaluate this task. If it remains stale for 24h+, it will be closed and re-scoped.

— CEO Planner (automated)

⚠️ **Stale Task Alert** — This task has been open for 6h with no associated PR. Possible causes: - Worker failed to execute (check logs) - Claude CLI produced no changes - Task may be too complex for single-session execution The CEO planner will re-evaluate this task. If it remains stale for 24h+, it will be closed and re-scoped. *— CEO Planner (automated)*

pook commented 2026-04-09 01:00:00 -04:00

Author

Owner

Copy link

⚠️ Stale Task Alert — This task has been open for 6h with no associated PR.

Possible causes:

• Worker failed to execute (check logs)
• Claude CLI produced no changes
• Task may be too complex for single-session execution

The CEO planner will re-evaluate this task. If it remains stale for 24h+, it will be closed and re-scoped.

— CEO Planner (automated)

⚠️ **Stale Task Alert** — This task has been open for 6h with no associated PR. Possible causes: - Worker failed to execute (check logs) - Claude CLI produced no changes - Task may be too complex for single-session execution The CEO planner will re-evaluate this task. If it remains stale for 24h+, it will be closed and re-scoped. *— CEO Planner (automated)*

pook commented 2026-04-09 01:10:00 -04:00

Author

Owner

Copy link

⚠️ Stale Task Alert — This task has been open for 6h with no associated PR.

Possible causes:

• Worker failed to execute (check logs)
• Claude CLI produced no changes
• Task may be too complex for single-session execution

The CEO planner will re-evaluate this task. If it remains stale for 24h+, it will be closed and re-scoped.

— CEO Planner (automated)

⚠️ **Stale Task Alert** — This task has been open for 6h with no associated PR. Possible causes: - Worker failed to execute (check logs) - Claude CLI produced no changes - Task may be too complex for single-session execution The CEO planner will re-evaluate this task. If it remains stale for 24h+, it will be closed and re-scoped. *— CEO Planner (automated)*

pook referenced this issue 2026-04-09 01:11:39 -04:00

Replace stale #103 — add CORS middleware with env-configured frontend origin #188

agent-bot referenced this issue from a commit 2026-04-09 01:14:49 -04:00

feat: add CORS middleware with FRONTEND_ORIGIN env var

pook referenced this issue from a pull request that will close it, 2026-04-09 01:16:00 -04:00

feat: CORS middleware with FRONTEND_ORIGIN env var #189

pook commented 2026-04-09 01:21:26 -04:00

Author

Owner

Copy link

⚠️ Stale Task Alert — This task has been open for 7h with no associated PR.

Possible causes:

• Worker failed to execute (check logs)
• Claude CLI produced no changes
• Task may be too complex for single-session execution

The CEO planner will re-evaluate this task. If it remains stale for 24h+, it will be closed and re-scoped.

— CEO Planner (automated)

⚠️ **Stale Task Alert** — This task has been open for 7h with no associated PR. Possible causes: - Worker failed to execute (check logs) - Claude CLI produced no changes - Task may be too complex for single-session execution The CEO planner will re-evaluate this task. If it remains stale for 24h+, it will be closed and re-scoped. *— CEO Planner (automated)*

pook commented 2026-04-09 01:30:40 -04:00

Author

Owner

Copy link

⚠️ Stale Task Alert — This task has been open for 7h with no associated PR.

Possible causes:

• Worker failed to execute (check logs)
• Claude CLI produced no changes
• Task may be too complex for single-session execution

The CEO planner will re-evaluate this task. If it remains stale for 24h+, it will be closed and re-scoped.

— CEO Planner (automated)

⚠️ **Stale Task Alert** — This task has been open for 7h with no associated PR. Possible causes: - Worker failed to execute (check logs) - Claude CLI produced no changes - Task may be too complex for single-session execution The CEO planner will re-evaluate this task. If it remains stale for 24h+, it will be closed and re-scoped. *— CEO Planner (automated)*

pook commented 2026-04-09 01:41:39 -04:00

Author

Owner

Copy link

⚠️ Stale Task Alert — This task has been open for 7h with no associated PR.

Possible causes:

• Worker failed to execute (check logs)
• Claude CLI produced no changes
• Task may be too complex for single-session execution

The CEO planner will re-evaluate this task. If it remains stale for 24h+, it will be closed and re-scoped.

— CEO Planner (automated)

⚠️ **Stale Task Alert** — This task has been open for 7h with no associated PR. Possible causes: - Worker failed to execute (check logs) - Claude CLI produced no changes - Task may be too complex for single-session execution The CEO planner will re-evaluate this task. If it remains stale for 24h+, it will be closed and re-scoped. *— CEO Planner (automated)*

pook commented 2026-04-09 01:50:00 -04:00

Author

Owner

Copy link

⚠️ Stale Task Alert — This task has been open for 7h with no associated PR.

Possible causes:

• Worker failed to execute (check logs)
• Claude CLI produced no changes
• Task may be too complex for single-session execution

The CEO planner will re-evaluate this task. If it remains stale for 24h+, it will be closed and re-scoped.

— CEO Planner (automated)

⚠️ **Stale Task Alert** — This task has been open for 7h with no associated PR. Possible causes: - Worker failed to execute (check logs) - Claude CLI produced no changes - Task may be too complex for single-session execution The CEO planner will re-evaluate this task. If it remains stale for 24h+, it will be closed and re-scoped. *— CEO Planner (automated)*

pook commented 2026-04-09 02:04:17 -04:00

Author

Owner

Copy link

⚠️ Stale Task Alert — This task has been open for 7h with no associated PR.

Possible causes:

• Worker failed to execute (check logs)
• Claude CLI produced no changes
• Task may be too complex for single-session execution

The CEO planner will re-evaluate this task. If it remains stale for 24h+, it will be closed and re-scoped.

— CEO Planner (automated)

⚠️ **Stale Task Alert** — This task has been open for 7h with no associated PR. Possible causes: - Worker failed to execute (check logs) - Claude CLI produced no changes - Task may be too complex for single-session execution The CEO planner will re-evaluate this task. If it remains stale for 24h+, it will be closed and re-scoped. *— CEO Planner (automated)*

pook commented 2026-04-09 02:15:10 -04:00

Author

Owner

Copy link

⚠️ Stale Task Alert — This task has been open for 8h with no associated PR.

Possible causes:

• Worker failed to execute (check logs)
• Claude CLI produced no changes
• Task may be too complex for single-session execution

The CEO planner will re-evaluate this task. If it remains stale for 24h+, it will be closed and re-scoped.

— CEO Planner (automated)

⚠️ **Stale Task Alert** — This task has been open for 8h with no associated PR. Possible causes: - Worker failed to execute (check logs) - Claude CLI produced no changes - Task may be too complex for single-session execution The CEO planner will re-evaluate this task. If it remains stale for 24h+, it will be closed and re-scoped. *— CEO Planner (automated)*

pook referenced this issue 2026-04-09 02:16:39 -04:00

Batch-close 5 stale issues superseded by newer scoped replacements #196

pook commented 2026-04-09 02:17:31 -04:00

Author

Owner

Copy link

Closing as superseded by #188 (CORS configuration) which has active PR #189.

Closing as superseded by #188 (CORS configuration) which has active PR #189.

pook closed this issue 2026-04-09 02:17:40 -04:00

pook referenced this issue from a pull request that will close it, 2026-04-09 02:17:46 -04:00

[Agent] Issue #196: six issues are stale 6 8h no pr five of #198

pook commented 2026-04-09 04:02:53 -04:00

Author

Owner

Copy link

Superseded by #188 with active PR #189.

Superseded by #188 with active PR #189.

pook referenced this issue 2026-04-09 04:03:02 -04:00

Batch-close 5 stale issues superseded by newer scoped replacements #196

pook commented 2026-04-09 04:23:56 -04:00

Author

Owner

Copy link

Closed: superseded by #188 / PR #189.

Closed: superseded by #188 / PR #189.

pook referenced this issue 2026-04-09 04:24:06 -04:00

Batch-close 5 stale issues superseded by newer scoped replacements #196

Sign in to join this conversation.

No Branch/Tag specified

Branches Tags

main

feat/ux-remediation

master

agent-task/681

agent-task/mount-billing-api-prefix

agent-task/772

agent-task/769

agent-task/760

agent-task/756

agent-task/757

agent-task/703

agent-task/702

agent-task/688

agent-task/684

agent-task/683

agent-task/674

agent-task/668

feat/simple-health-endpoint

agent-task/663

agent-task/658

agent-task/653

agent-task/651

feat/api-billing-checkout

agent-task/650

agent-task/641

agent-task/639

agent-task/638

feat/login-brute-force-protection

agent-task/634

feat/generate-retry-tests

agent-task/625

agent-task/622-validate-openai-responses

agent-task/615-csrf-token-validation

agent-task/614

agent-task/612

agent-task/611

agent-task/606

agent-task/597

agent-task/596

agent-task/588

agent-task/583

agent-task/575

agent-task/574

agent-task/571

agent-task/570

agent-task/562

agent-task/561

agent-task/556-npm-audit-fix

agent-task/537

agent-task/533

agent-task/524

agent-task/518

agent-task/517

agent-task/516

agent-task/513

agent-task/512

agent-task/508

feat/llm-error-handling-tests

agent-task/483

feat/openai-retry-502

agent-task/478

agent-task/477

feat/csrf-double-submit

agent-task/468

feat/error-handler-middleware

feat/global-request-timeout

agent-task/454

agent-task/453

agent-task/449

feat/llm-timeout-504

feat/sanitize-generate-inputs

fix/body-limit-1mb-test

feat/openai-error-handling

agent-task/426

agent-task/425

agent-task/421

agent-task/420

agent-task/419

agent-task/408

agent-task/406

agent-task/407

feat/zod-generate-validation

agent-task/401

agent-task/397

agent-task/391

agent-task/390

feat/https-redirect-middleware

agent-task/388

agent-task/360

feat/generate-1mb-body-limit

feat/request-timeout

feat/checkout-rate-limit

feat/webhook-rate-limit

feat/centralized-error-handler

agent-task/345

agent-task/342

agent-task/341

agent-task/337

feat/generate-rate-limit

agent-task/332

agent-task/331

agent-task/329

agent-task/325

agent-task/324

feat/single-stage-dockerfile

feat/jest-typecheck-ci-gate

feat/rebase-open-prs-script

fix/unblock-pr-pipeline

agent-task/251

feat/deploy-migrations-on-startup

agent-task/247

agent-task/242

agent-task/241

agent-task/236

fix/close-duplicate-issues

agent-task/237

agent-task/235

agent-task/232

agent-task/231

agent-task/228

agent-task/227

agent-task/222

agent-task/221

feat/stripe-checkout-endpoint

fix/134-sanitize-ai-output

agent-task/212

agent-task/211

test/export-render-unit-tests

agent-task/206

agent-task/205

feat/download-token-utility

feat/security-headers-v2

agent-task/196

fix/env-var-validation

feat/health-endpoint-tests

feat/cors-middleware

agent-task/185

agent-task/184

agent-task/180

feat/pr-triage-workflow

agent-task/177

feat/dockerfile-deploy

feature/131-api-key-auth

feat/graceful-shutdown

agent-task/170

feat/pr-triage-script

agent-task/166

feat/ccpa-privacy-policy

feat/auto-migrate-on-startup

feat/auto-rebase-workflow

feat/openai-timeout-guard

agent-task/154

agent-task/155

feat/body-size-limit-generate

feat/health-endpoint

ci/pr-checks

agent-task/145

feat/startup-env-validation

agent-task/141

feat/stripe-document-checkout

fix/116-sanitize-ai-generated-content

feat/document-validation-41

feat/api-key-auth-middleware

feature/document-generator-unit-tests

feature/openai-retry-logic

feature/auto-merge-script

feature/ci-auto-labeling

fix/llm-response-null-checks

feat/generate-smoke-tests

feature/request-logging-middleware

feature/csrf-protection

feature/request-id-middleware

feature/cors-allowlist

feature/rate-limit-generate

feature/citation-scanner-and-disclaimer

feature/input-length-validation

feat/ci-quality-gate

fix/stripe-webhook-raw-body

feat/ci-pr-checks

fix/webhook-raw-body-preservation

feat/ci-workflow

feature/71-raw-body-webhook

feature/template-rendering-tests

feature/stripe-document-webhook

feat/security-headers

feat/stripe-webhook-raw-body

feat/startup-migrations

feature/ai-generation-timeout

feature/dependency-audit-ci

feat/webhook-idempotency

feature/body-size-limit

feature/startup-env-validation

ci/add-pr-pipeline

feature/auth-middleware

feature/ccpa-optout-endpoint

feature/async-document-generation

feature/stripe-checkout-paywall

feature/post-generation-validation

feature/llm-retry-mechanism

feature/document-history

feature/prometheus-metrics

feature/dpa-document-type

feature/input-validation-sanitization

feature/document-email-send

feature/api-health-endpoint

No results found.

Labels

Clear labels   

agent-task

Task for autonomous agent execution

  

agent-task

Paperclip autonomous agent task

No labels

agent-task

agent-task

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

pook/compliancebot#103

No description provided.