Spaces:
Sleeping
Sleeping
| import os | |
| from typing import List | |
| from fastapi import FastAPI | |
| from fastapi.middleware.cors import CORSMiddleware | |
| # Reuse the same prod-detection heuristic used by validate_api_key_configuration | |
| # (ENV=production or HF Spaces SPACE_ID/HF_HOME) so the two startup checks are | |
| # consistent. | |
| from app.core.auth import _is_production_like | |
| from app.core.logging import get_logger | |
| logger = get_logger(__name__) | |
| def _get_allowed_origins() -> List[str]: | |
| """Return the CORS origin allowlist. | |
| - ALLOWED_ORIGINS env var (comma-separated): use that list. | |
| - Unset / empty: fall back to ["*"] for permissive local-dev behaviour. | |
| This default is only safe because allow_credentials is always False — | |
| the WHATWG Fetch Standard forbids wildcard origins + credentials together, | |
| and browsers reject that combination. | |
| """ | |
| # Read via os.getenv rather than get_settings() because get_settings() is | |
| # an lru_cache singleton — test-time env-var overrides (used by | |
| # TestGetAllowedOrigins) would not be reflected in an already-cached | |
| # instance. ALLOWED_ORIGINS is read once at startup (configure_security is | |
| # called during app init), so the behaviour is identical to a Settings field. | |
| raw = os.getenv("ALLOWED_ORIGINS") | |
| if not raw: | |
| return ["*"] | |
| origins = [item.strip() for item in raw.split(",") if item.strip()] | |
| return origins if origins else ["*"] | |
| def configure_security(app: FastAPI) -> None: | |
| """Configure CORS on the FastAPI app. | |
| API key enforcement is handled via dependencies in app.core.auth. | |
| allow_credentials is always False: the API authenticates with a bearer | |
| API key (X-API-Key header), not cookies. Combining wildcard origins with | |
| allow_credentials=True is invalid per the WHATWG Fetch Standard and is | |
| rejected by browsers; bearer-token auth has no need for credentials mode. | |
| """ | |
| origins = _get_allowed_origins() | |
| if origins == ["*"] and _is_production_like(): | |
| logger.warning( | |
| "CORS origins resolved to wildcard ('*') in a production-like " | |
| "environment. Set ALLOWED_ORIGINS to a comma-separated list of " | |
| "trusted origins (e.g. 'https://my-app.hf.space,https://my-ui.com'). " | |
| "Wildcard origins are acceptable for local development only." | |
| ) | |
| app.add_middleware( | |
| CORSMiddleware, | |
| allow_origins=origins, | |
| # always False — bearer-token (X-API-Key) auth, not cookies. | |
| # Wildcard origins + credentials is invalid per the WHATWG Fetch Standard. | |
| allow_credentials=False, | |
| allow_methods=["*"], | |
| allow_headers=["*"], | |
| ) | |
| logger.info("CORS configured allow_origins=%s allow_credentials=False", origins) | |