Fix CORS setup #1782
Open
Fix CORS setup #1782
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
mypy eek |
pamelafox
reviewed
Jul 3, 2024
| @@ -283,7 +293,7 @@ module backend 'core/host/appservice.bicep' = { | |||
| managedIdentity: true | |||
| virtualNetworkSubnetId: isolation.outputs.appSubnetId | |||
| publicNetworkAccess: publicNetworkAccess | |||
| allowedOrigins: [ allowedOrigin ] | |||
| allowedOrigins: allowedOrigins | |||
There was a problem hiding this comment.
Does this always end up allowing origins even if they don't enable user auth? I dont see a conditional that makes it empty in that case. But maybe my eyes have glazed over.
There was a problem hiding this comment.
Or maybe we always allowed them anyway?
There was a problem hiding this comment.
allowedOrigin should be empty if they don't enable user auth. I will double check this, good catch
There was a problem hiding this comment.
So this is an interesting case
- We were never enabling the portal origins before due to a bug
- So unless they explicitly specified an allowed origin, we never enabled cors
My thought is that we want to only add in the portal / login origins if auth is enabled, otherwise just pick the origins they added. I'll make this adjustment
mattgotteiner
commented
Jul 8, 2024
| allowed_origin = allowed_origin.split(";") | ||
| if len(allowed_origin) > 0: | ||
| app.logger.info("CORS enabled for %s", allowed_origin) | ||
| cors(app, allow_origin=allowed_origin, allow_methods=["GET", "POST"]) |
There was a problem hiding this comment.
We do need to allow credentials
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Purpose
Does this introduce a breaking change?
When developers merge from main and run the server, azd up, or azd deploy, will this produce an error?
If you're not sure, try it out on an old environment.
Does this require changes to learn.microsoft.com docs?
This repository is referenced by this tutorial
which includes deployment, settings and usage instructions. If text or screenshot need to change in the tutorial,
check the box below and notify the tutorial author. A Microsoft employee can do this for you if you're an external contributor.
Type of change