Merge pull request #21 from silvanmelchior/disable-cors

Disable cors

CONTRIBUTING.md

@@ -43,6 +43,7 @@ poetry install
 poetry shell
 export IPYTHON_PATH=/home/user/venv_interpreter/bin/ipython
 export WORKING_DIRECTORY=/home/user/ipilot
+export ALLOWED_HOSTS="localhost:3000"
 uvicorn main_interpreter:app --reload --port 8000
 ```
 
@@ -51,6 +52,7 @@ Open a second terminal in the *services* folder and run the following:
 ```shell
 poetry shell
 export OPENAI_API_KEY=sk-your-api-key
+export ALLOWED_HOSTS="localhost:3000"
 uvicorn main_llm:app --reload --port 8001
 ```
 

README.md

@@ -51,6 +51,7 @@ Follow these steps:
 docker run -i -t \
   -p 3030:80 \
   -e OPENAI_API_KEY="sk-your-api-key" \
+  -e ALLOWED_HOSTS="localhost:3030" \
   -v /home/user/ipilot:/mnt/data \
   silvanmelchior/incognito-pilot:latest-slim
 ```
@@ -101,11 +102,13 @@ Please note that GPT-4 is considerably better in the interpreter setup than GPT-
 
 ### Change port
 
-To serve the UI at a different port than 3030, just expose the internal port 80 to a different one, for example 8080:
+To serve the UI at a different port than 3030, you can expose the internal port 80 to a different one, for example 8080.
+You should also change the allowed host variable in this case:
 
 ```shell
 docker run -i -t \
   -p 8080:80 \
+  -e ALLOWED_HOSTS="localhost:8080" \
   ... \
   silvanmelchior/incognito-pilot
 ```

docs/INSTALLATION_AZURE.md

@@ -19,6 +19,7 @@ docker run -i -t \
   -e LLM="gpt-azure:your-deployment-name" \
   -e AZURE_API_KEY="your-azure-openai-api-key" \
   -e AZURE_API_BASE="https://your-azure-openai-service-name.openai.azure.com/" \
+  -e ALLOWED_HOSTS="localhost:3030" \
   -v /home/user/ipilot:/mnt/data \
   silvanmelchior/incognito-pilot:latest-slim
 ```

docs/INSTALLATION_LLAMA.md

@@ -31,6 +31,7 @@ docker run -i -t \
   -p 3030:80 \
   -e LLM="llama-replicate:replicate/llama-2-70b-chat:2c1608e18606fad2812020dc541930f2d0495ce32eee50074220b87300bc16e1" \
   -e REPLICATE_API_KEY="your-replicate-api-key" \
+  -e ALLOWED_HOSTS="localhost:3030" \
   -v /home/user/ipilot:/mnt/data \
   silvanmelchior/incognito-pilot:latest-slim
 ```

services/main_interpreter.py

@@ -4,8 +4,7 @@
 from websockets.exceptions import ConnectionClosedError
 
 from interpreter import IPythonInterpreter
-from utils import get_app, get_env_var
-
+from utils import get_app, get_env_var, verify_origin
 
 app = get_app()
 
@@ -27,6 +26,9 @@ def get_interpreter() -> IPythonInterpreter:
 
 @app.websocket("/api/interpreter/run")
 async def run(websocket: WebSocket):
+    if not verify_origin(websocket.headers["origin"]):
+        return
+
     ws_exceptions = WebSocketDisconnect, ConnectionClosedError
 
     try:

services/main_llm.py

@@ -6,8 +6,7 @@
 from websockets.exceptions import ConnectionClosedError
 
 from llm import LLMException, Message, get_llm
-from utils import get_app, get_env_var
-
+from utils import get_app, get_env_var, verify_origin
 
 app = get_app()
 
@@ -21,6 +20,9 @@ class Request(BaseModel):
 
 @app.websocket("/api/llm/chat")
 async def chat(websocket: WebSocket):
+    if not verify_origin(websocket.headers["origin"]):
+        return
+
     ws_exceptions = WebSocketDisconnect, ConnectionClosedError
 
     try:

services/utils/__init__.py

@@ -1,2 +1,3 @@
 from .app import get_app
 from .env_var import get_env_var
+from .origin import verify_origin

services/utils/app.py

@@ -1,14 +1,17 @@
 from fastapi import FastAPI
 from fastapi.middleware.cors import CORSMiddleware
 
+from .env_var import get_env_var
+
 
 def get_app() -> FastAPI:
     app = FastAPI()
-    app.add_middleware(
-        CORSMiddleware,
-        allow_origins=["*"],
-        allow_credentials=True,
-        allow_methods=["*"],
-        allow_headers=["*"],
-    )
+    if get_env_var("ENABLE_CORS", "FALSE") == "TRUE":
+        app.add_middleware(
+            CORSMiddleware,
+            allow_origins=["*"],
+            allow_credentials=True,
+            allow_methods=["*"],
+            allow_headers=["*"],
+        )
     return app

services/utils/origin.py

@@ -0,0 +1,8 @@
+from .env_var import get_env_var
+
+ALLOWED_HOSTS = get_env_var("ALLOWED_HOSTS").split(" ")
+
+
+def verify_origin(origin: str) -> bool:
+    origin_raw = origin.replace("http://", "").replace("https://", "")
+    return origin_raw in ALLOWED_HOSTS