Merge pull request #969 from hackforla/mattyweb/issue954

Add CORS checks
hackforla · Feb 24, 2021 · 13df705 · 13df705
2 parents 6248468 + 0f55f8e
commit 13df705
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 2 deletions.
diff --git a/server/api/code/lacity_data_api/config.py b/server/api/code/lacity_data_api/config.py
@@ -18,6 +18,12 @@
 TESTING = config("TESTING", cast=bool, default=False)
 STAGE = config("STAGE", default="Local")
 
+# string array of allows client URLs
+API_ALLOWED_ORIGINS = config(
+    "API_ALLOWED_ORIGINS",
+    default=["http://localhost:3000", "https://*.311-data.org"]
+)
+
 # getting database configuration
 DB_DRIVER = config("DB_DRIVER", default="postgresql")
 DB_HOST = config("DB_HOST", default="localhost")

diff --git a/server/api/code/lacity_data_api/main.py b/server/api/code/lacity_data_api/main.py
@@ -6,7 +6,7 @@
 from fastapi.middleware.cors import CORSMiddleware
 from fastapi.middleware.gzip import GZipMiddleware
 
-from .config import DEBUG
+from .config import DEBUG, API_ALLOWED_ORIGINS
 from .models import db
 from .routers import (
     index, councils, regions, request_types, service_requests, shim, status,
@@ -45,7 +45,7 @@ def get_app():
 
     app.add_middleware(
         CORSMiddleware,
-        allow_origins=["*"],
+        allow_origins=API_ALLOWED_ORIGINS,
         allow_credentials=True,
         allow_methods=["*"],
         allow_headers=["*"],