Skip to content

Support HEAD method for health checks and allow localhost in staging #75

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
stenwire merged 2 commits into from
Jul 4, 2026
Merged

Support HEAD method for health checks and allow localhost in staging #75

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
7b8716a
fix: support HEAD method on health check routes, allow localhost in s…
stenwire Jul 4, 2026
986e26a
Merge pull request #74 from stenwire/root-dir-dockerfile
stenwire Jul 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions backend/app/core/config.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -96,6 +96,8 @@ class StagingConfig(BaseConfig):
ALLOWED_HOSTS: List[str] = [
"taimako.onrender.com",
"taimakoai.onrender.com",

@github-actions github-actions Bot Jul 4, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟢 Adding localhost and 127.0.0.1 to ALLOWED_HOSTS in the StagingConfig is a good practice for local development and enabling health checks from local network tools.

"localhost",
"127.0.0.1",
]
Comment on lines 96 to 101

@gemini-code-assist gemini-code-assist Bot Jul 4, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security-high high

Security Vulnerability: Host Header Injection in Staging Environment

Allowing localhost and 127.0.0.1 in the ALLOWED_HOSTS list of a deployed environment (even staging) introduces a security risk. If the application is deployed and accessible publicly, an attacker can send requests with a spoofed Host: localhost or Host: 127.0.0.1 header. If the application uses the host header to construct absolute URLs (e.g., for password reset links, email confirmations, or OAuth redirects), this can lead to Host Header Injection vulnerabilities.

Recommendation:
Remove localhost and 127.0.0.1 from the hardcoded StagingConfig.ALLOWED_HOSTS. If you need to test the staging configuration locally, you can dynamically override ALLOWED_HOSTS using environment variables (which pydantic-settings supports out of the box) rather than hardcoding them in the class definition.

    ALLOWED_HOSTS: List[str] = [
        "taimako.onrender.com",
        "taimakoai.onrender.com",
    ]


class ProductionConfig(BaseConfig):
Expand Down
4 changes: 2 additions & 2 deletions backend/app/main.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -91,10 +91,10 @@
app.include_router(orders_router)


@github-actions github-actions Bot Jul 4, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changing @app.get to @app.api_route(..., methods=["GET", "HEAD"]) for the root and health endpoints is a great improvement for supporting HEAD requests. This makes the endpoints more robust and efficient for health checks.
Consider adding unit tests specifically for the HEAD method on these routes to ensure they function as expected and return the correct status without a response body.

@app.get("/")
@app.api_route("/", methods=["GET", "HEAD"])
async def root():
return success_response(message="Agentic RAG API is running")

@app.get("/health")
@app.api_route("/health", methods=["GET", "HEAD"])
async def health_check():
return {"status": "healthy"}
Loading