From 976dfe02a08b64e99ce3b7d1730168c071c22803 Mon Sep 17 00:00:00 2001 From: Anshul Jain Date: Thu, 30 Jul 2026 13:04:58 +0530 Subject: [PATCH] fix(docker): configure CORS origins for frontend in Docker Compose Adds SECUSCAN_CORS_ALLOWED_ORIGINS environment variable to the api service in docker-compose.yml, explicitly configuring which browser origins are allowed to make requests to the backend API. Previously, CORS relied on backend defaults. This explicitly sets the allowed origins to localhost and 127.0.0.1 on common dev/test ports (5173, 3000, 8080), ensuring the frontend can communicate with the backend in containerized environments. Excludes Docker service names (e.g. http://frontend:5173) since they are internal to the container network and not accessible from browsers. Adds integration test to validate CORS configuration from environment variables. --- docker-compose.yml | 1 + .../integration/test_docker_compose_cors.py | 65 +++++++++++++++++++ 2 files changed, 66 insertions(+) create mode 100644 testing/backend/integration/test_docker_compose_cors.py diff --git a/docker-compose.yml b/docker-compose.yml index 28e1433ac..c059dfa24 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -46,6 +46,7 @@ services: - SECUSCAN_POSTGRES_DSN=postgresql://${SECUSCAN_POSTGRES_USER:-secuscan}:${SECUSCAN_POSTGRES_PASSWORD:-secuscan}@postgres:5432/${SECUSCAN_POSTGRES_DB:-secuscan} - SECUSCAN_REDIS_URL=redis://redis:6379/0 - SECUSCAN_PLUGINS_DIR=/app/plugins + - SECUSCAN_CORS_ALLOWED_ORIGINS=http://localhost:5173,http://127.0.0.1:5173,http://localhost:3000,http://127.0.0.1:3000,http://localhost:8080,http://127.0.0.1:8080 depends_on: postgres: condition: service_healthy diff --git a/testing/backend/integration/test_docker_compose_cors.py b/testing/backend/integration/test_docker_compose_cors.py new file mode 100644 index 000000000..5e82d0026 --- /dev/null +++ b/testing/backend/integration/test_docker_compose_cors.py @@ -0,0 +1,65 @@ +"""Test CORS configuration in Docker Compose setup. + +Validates that the backend correctly configures CORS allowed origins +from environment variables when running in Docker Compose. +""" + +import os +import pytest + + +def test_cors_origins_from_env(): + """Verify CORS origins are correctly configured from env var.""" + # This simulates the Docker Compose environment + os.environ["SECUSCAN_CORS_ALLOWED_ORIGINS"] = ( + "http://localhost:5173," + "http://127.0.0.1:5173," + "http://localhost:3000," + "http://127.0.0.1:3000," + "http://localhost:8080," + "http://127.0.0.1:8080" + ) + + # Import after env var is set + from secuscan.config import Settings + + settings = Settings() + cors_origins = settings.cors_allowed_origins + + expected = [ + "http://localhost:5173", + "http://127.0.0.1:5173", + "http://localhost:3000", + "http://127.0.0.1:3000", + "http://localhost:8080", + "http://127.0.0.1:8080", + ] + + assert cors_origins == expected + + +def test_no_docker_service_names_in_cors(): + """Ensure Docker service names (http://frontend:5173) are not in CORS origins. + + Docker service names are internal to the container network and cannot be + used by browsers. Only browser-accessible origins should be allowed. + """ + os.environ["SECUSCAN_CORS_ALLOWED_ORIGINS"] = ( + "http://localhost:5173," + "http://127.0.0.1:5173," + "http://localhost:3000," + "http://127.0.0.1:3000," + "http://localhost:8080," + "http://127.0.0.1:8080" + ) + + from secuscan.config import Settings + + settings = Settings() + cors_origins = settings.cors_allowed_origins + + # Verify no Docker service names are in the list + assert "http://frontend:5173" not in cors_origins + assert "http://api:8081" not in cors_origins + assert "http://postgres:5432" not in cors_origins + assert "http://redis:6379" not in cors_origins