Repository navigation
fix(app): restrict default CORS origins to deploy_url in prod mode - #7641
FarhanAliRaza wants to merge 2 commits into
Conversation
The `["*"]` default for `cors_allowed_origins` let any site connect to the backend. In prod mode the default now narrows to the origin of `deploy_url` (or nothing when `deploy_url` is unset), while an explicit `cors_allowed_origins`, from rxconfig or the environment, is used as is. Dev mode keeps allowing any origin. Both the Starlette CORS middleware and the Socket.IO server resolve their origins through one helper. Closes #7640 Claude-Session: https://claude.ai/code/session_01C1xrGYmKsaacgEafTz9BTJ
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
FarhanAliRaza
added
the
breaking
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ed3738cb94
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
 [Medium impact] The PR appears safe to merge; the remaining WebSocket test gap is non-blocking. SummaryRestricts default production CORS origins to the origin of
Reviews (2) · Last reviewed commit: "fix(app): normalize deploy_url to a brow..." · Reviewed by Greptile |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
All reported issues were addressed across 6 files
Reply with feedback, questions, or to request a fix.
View guided diff | Turn on auto-fix | Re-trigger cubic
Browsers serialize the Origin header with a lowercase host and without the scheme's default port, so `https://Example.com:443/app` must allow `https://example.com`. Also cover CORS enforcement with request-level tests for the HTTP middleware and the Socket.IO origin check. Claude-Session: https://claude.ai/code/session_01C1xrGYmKsaacgEafTz9BTJ
There was a problem hiding this comment.
All reported issues were addressed across 2 files (changes from recent commits).
Reply with feedback, questions, or to request a fix.
View guided diff | Turn on auto-fix | Re-trigger cubic
Merging this PR will not alter performance1 warning
Comparing 
|
All Submissions:
Type of change
Changes To Core Features:
Description
closes #7640
The
["*"]default forcors_allowed_originslet any site connect to the backend. This PR makes the default mode-aware:deploy_url. Ifdeploy_urlisNone, no cross-origin request is accepted.cors_allowed_origins(fromrxconfig.pyorREFLEX_CORS_ALLOWED_ORIGINS) is used as is in both modes, so["*"]remains an opt-in to the old behavior. Explicitness is detected viaConfig._non_default_attributes, not by comparing against the default tuple.Both enforcement points, the Starlette
CORSMiddlewareand the Socket.IOAsyncServer, now resolve their origins through one helper,_cors_allowed_origins()inreflex/app.py. Passing the list straight through to engineio is equivalent to the old"*"special case, since engineio treats a list containing"*"as allow-all.deploy_urlis reduced to an origin serialized the way browsers serialize theOriginheader: lowercase host, no path, and the scheme's default port omitted (https://Example.COM:443/app→https://example.com). Non-default ports and IPv6 hosts are kept.Notes
AppHarnesspins dev mode before building the app, soAppHarnessProdstill resolves to["*"].reflex run --env prodand the defaultdeploy_urlofhttp://localhost:3000, opening the app via127.0.0.1:3000is now rejected. Setdeploy_urlorcors_allowed_originsfor alternate origins.Tests
Unit tests cover dev vs prod, path-bearing and default-port
deploy_urlforms, unsetdeploy_url, explicit lists, explicit["*"]via kwargs and via env, and request-level enforcement: a preflight through Starlette'sTestClientfrom thedeploy_urlorigin passes while other origins are refused, with the same cases checked against Engine.IO's origin resolution. News fragments added forreflex(breaking) andreflex-base(docs).https://claude.ai/code/session_01C1xrGYmKsaacgEafTz9BTJ