Skip to content

Commit e373d7b

Browse files
RushanNanayakkaraRushanNanayakkara
authored
Merge pull request #2494 from RushanNanayakkara/thunder-cors-config
Harden CORS origin matching and preflight handling
2 parents cf442cf + 86bd701 commit e373d7b

53 files changed

Lines changed: 2471 additions & 477 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.vale/styles/config/vocabularies/vocab/accept.txt‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -61,4 +61,5 @@ ACLs
6161
[Bb]ackoff
6262
[Rr]etryable
6363
[Uu]psert
64-
[Ii]dempotency
64+
[Ii]dempotency
65+
[Ss]andboxed

‎backend/cmd/server/repository/conf/deployment.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,7 @@ jwt:
5151
cors:
5252
allowed_origins:
5353
- "https://localhost:3000"
54+
# - regex: '^https://[a-z0-9-]+\.staging\.example\.com(:[0-9]+)?$'
5455

5556
passkey:
5657
allowed_origins:

‎backend/internal/application/init.go‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -75,9 +75,10 @@ func Initialize(
7575

7676
func registerRoutes(mux *http.ServeMux, appHandler *applicationHandler) {
7777
opts1 := middleware.CORSOptions{
78-
AllowedMethods: "GET, POST",
79-
AllowedHeaders: "Content-Type, Authorization",
78+
AllowedMethods: []string{"GET", "POST"},
79+
AllowedHeaders: middleware.DefaultAllowedHeaders,
8080
AllowCredentials: true,
81+
MaxAge: 600,
8182
}
8283
mux.HandleFunc(middleware.WithCORS("POST /applications",
8384
appHandler.HandleApplicationPostRequest, opts1))
@@ -89,9 +90,10 @@ func registerRoutes(mux *http.ServeMux, appHandler *applicationHandler) {
8990
}, opts1))
9091

9192
opts2 := middleware.CORSOptions{
92-
AllowedMethods: "GET, PUT, DELETE",
93-
AllowedHeaders: "Content-Type, Authorization",
93+
AllowedMethods: []string{"GET", "PUT", "DELETE"},
94+
AllowedHeaders: middleware.DefaultAllowedHeaders,
9495
AllowCredentials: true,
96+
MaxAge: 600,
9597
}
9698
mux.HandleFunc(middleware.WithCORS("GET /applications/{id}",
9799
appHandler.HandleApplicationGetRequest, opts2))

‎backend/internal/authn/init.go‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -113,9 +113,10 @@ func Initialize(
113113
// registerRoutes registers the routes for the authentication.
114114
func registerRoutes(mux *http.ServeMux, authnHandler *authenticationHandler) {
115115
opts := middleware.CORSOptions{
116-
AllowedMethods: "POST",
117-
AllowedHeaders: "Content-Type, Authorization",
116+
AllowedMethods: []string{"POST"},
117+
AllowedHeaders: middleware.DefaultAllowedHeaders,
118118
AllowCredentials: true,
119+
MaxAge: 600,
119120
}
120121

121122
// Credentials authentication routes

‎backend/internal/design/layout/mgt/init.go‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -101,9 +101,10 @@ func initializeStore() (layoutMgtStoreInterface, error) {
101101
// registerRoutes registers the routes for layout management operations.
102102
func registerRoutes(mux *http.ServeMux, layoutMgtHandler *layoutMgtHandler) {
103103
opts1 := middleware.CORSOptions{
104-
AllowedMethods: "GET, POST",
105-
AllowedHeaders: "Content-Type, Authorization",
104+
AllowedMethods: []string{"GET", "POST"},
105+
AllowedHeaders: middleware.DefaultAllowedHeaders,
106106
AllowCredentials: true,
107+
MaxAge: 600,
107108
}
108109
mux.HandleFunc(middleware.WithCORS("POST /design/layouts", layoutMgtHandler.HandleLayoutPostRequest, opts1))
109110
mux.HandleFunc(middleware.WithCORS("GET /design/layouts", layoutMgtHandler.HandleLayoutListRequest, opts1))
@@ -112,9 +113,10 @@ func registerRoutes(mux *http.ServeMux, layoutMgtHandler *layoutMgtHandler) {
112113
}, opts1))
113114

114115
opts2 := middleware.CORSOptions{
115-
AllowedMethods: "GET, PUT, DELETE",
116-
AllowedHeaders: "Content-Type, Authorization",
116+
AllowedMethods: []string{"GET", "PUT", "DELETE"},
117+
AllowedHeaders: middleware.DefaultAllowedHeaders,
117118
AllowCredentials: true,
119+
MaxAge: 600,
118120
}
119121
mux.HandleFunc(middleware.WithCORS("GET /design/layouts/{id}", layoutMgtHandler.HandleLayoutGetRequest, opts2))
120122
mux.HandleFunc(middleware.WithCORS("PUT /design/layouts/{id}", layoutMgtHandler.HandleLayoutPutRequest, opts2))

‎backend/internal/design/resolve/init.go‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -43,9 +43,10 @@ func Initialize(
4343
// registerRoutes registers the routes for design resolve operations.
4444
func registerRoutes(mux *http.ServeMux, resolveHandler *designResolveHandler) {
4545
opts := middleware.CORSOptions{
46-
AllowedMethods: "GET",
47-
AllowedHeaders: "Content-Type, Authorization",
46+
AllowedMethods: []string{"GET"},
47+
AllowedHeaders: middleware.DefaultAllowedHeaders,
4848
AllowCredentials: true,
49+
MaxAge: 600,
4950
}
5051
mux.HandleFunc(middleware.WithCORS("GET /design/resolve", resolveHandler.HandleResolveRequest, opts))
5152
mux.HandleFunc(middleware.WithCORS("OPTIONS /design/resolve", func(w http.ResponseWriter, r *http.Request) {

‎backend/internal/design/theme/mgt/init.go‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -101,9 +101,10 @@ func initializeStore() (themeMgtStoreInterface, error) {
101101
// registerRoutes registers the routes for theme management operations.
102102
func registerRoutes(mux *http.ServeMux, themeMgtHandler *themeMgtHandler) {
103103
opts1 := middleware.CORSOptions{
104-
AllowedMethods: "GET, POST",
105-
AllowedHeaders: "Content-Type, Authorization",
104+
AllowedMethods: []string{"GET", "POST"},
105+
AllowedHeaders: middleware.DefaultAllowedHeaders,
106106
AllowCredentials: true,
107+
MaxAge: 600,
107108
}
108109
mux.HandleFunc(middleware.WithCORS("POST /design/themes", themeMgtHandler.HandleThemePostRequest, opts1))
109110
mux.HandleFunc(middleware.WithCORS("GET /design/themes", themeMgtHandler.HandleThemeListRequest, opts1))
@@ -112,9 +113,10 @@ func registerRoutes(mux *http.ServeMux, themeMgtHandler *themeMgtHandler) {
112113
}, opts1))
113114

114115
opts2 := middleware.CORSOptions{
115-
AllowedMethods: "GET, PUT, DELETE",
116-
AllowedHeaders: "Content-Type, Authorization",
116+
AllowedMethods: []string{"GET", "PUT", "DELETE"},
117+
AllowedHeaders: middleware.DefaultAllowedHeaders,
117118
AllowCredentials: true,
119+
MaxAge: 600,
118120
}
119121
mux.HandleFunc(middleware.WithCORS("GET /design/themes/{id}", themeMgtHandler.HandleThemeGetRequest, opts2))
120122
mux.HandleFunc(middleware.WithCORS("PUT /design/themes/{id}", themeMgtHandler.HandleThemePutRequest, opts2))

‎backend/internal/flow/flowexec/init.go‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -67,9 +67,10 @@ func Initialize(
6767

6868
func registerRoutes(mux *http.ServeMux, handler *flowExecutionHandler) {
6969
opts := middleware.CORSOptions{
70-
AllowedMethods: "POST",
71-
AllowedHeaders: "Content-Type, Authorization",
70+
AllowedMethods: []string{"POST"},
71+
AllowedHeaders: middleware.DefaultAllowedHeaders,
7272
AllowCredentials: true,
73+
MaxAge: 600,
7374
}
7475
mux.HandleFunc(middleware.WithCORS("POST /flow/execute",
7576
middleware.CorrelationIDMiddleware(http.HandlerFunc(handler.HandleFlowExecutionRequest)).ServeHTTP, opts))

‎backend/internal/flow/flowmeta/init.go‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -49,9 +49,10 @@ func Initialize(
4949
func registerRoutes(mux *http.ServeMux, handler *flowMetaHandler) {
5050
// CORS options for flow metadata endpoint (follows the same security as flow/execute)
5151
opts := middleware.CORSOptions{
52-
AllowedMethods: "GET, OPTIONS",
53-
AllowedHeaders: "Content-Type, Authorization",
52+
AllowedMethods: []string{"GET", "OPTIONS"},
53+
AllowedHeaders: middleware.DefaultAllowedHeaders,
5454
AllowCredentials: true,
55+
MaxAge: 600,
5556
}
5657

5758
// Register GET endpoint

‎backend/internal/flow/mgt/init.go‎

Lines changed: 12 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -149,9 +149,10 @@ func isCompositeModeEnabled() bool {
149149
// registerRoutes registers the HTTP routes for flow management.
150150
func registerRoutes(mux *http.ServeMux, handler *flowMgtHandler) {
151151
opts1 := middleware.CORSOptions{
152-
AllowedMethods: "GET, POST",
153-
AllowedHeaders: "Content-Type, Authorization",
152+
AllowedMethods: []string{"GET", "POST"},
153+
AllowedHeaders: middleware.DefaultAllowedHeaders,
154154
AllowCredentials: true,
155+
MaxAge: 600,
155156
}
156157
mux.HandleFunc(middleware.WithCORS("GET /flows", handler.listFlows, opts1))
157158
mux.HandleFunc(middleware.WithCORS("POST /flows", handler.createFlow, opts1))
@@ -160,9 +161,10 @@ func registerRoutes(mux *http.ServeMux, handler *flowMgtHandler) {
160161
}, opts1))
161162

162163
opts2 := middleware.CORSOptions{
163-
AllowedMethods: "GET, PUT, DELETE",
164-
AllowedHeaders: "Content-Type, Authorization",
164+
AllowedMethods: []string{"GET", "PUT", "DELETE"},
165+
AllowedHeaders: middleware.DefaultAllowedHeaders,
165166
AllowCredentials: true,
167+
MaxAge: 600,
166168
}
167169
mux.HandleFunc(middleware.WithCORS("GET /flows/{flowId}", handler.getFlow, opts2))
168170
mux.HandleFunc(middleware.WithCORS("PUT /flows/{flowId}", handler.updateFlow, opts2))
@@ -172,9 +174,10 @@ func registerRoutes(mux *http.ServeMux, handler *flowMgtHandler) {
172174
}, opts2))
173175

174176
opts3 := middleware.CORSOptions{
175-
AllowedMethods: "GET",
176-
AllowedHeaders: "Content-Type, Authorization",
177+
AllowedMethods: []string{"GET"},
178+
AllowedHeaders: middleware.DefaultAllowedHeaders,
177179
AllowCredentials: true,
180+
MaxAge: 600,
178181
}
179182
mux.HandleFunc(middleware.WithCORS("GET /flows/{flowId}/versions", handler.listFlowVersions, opts3))
180183
mux.HandleFunc(middleware.WithCORS("OPTIONS /flows/{flowId}/versions",
@@ -190,9 +193,10 @@ func registerRoutes(mux *http.ServeMux, handler *flowMgtHandler) {
190193
)
191194

192195
opts4 := middleware.CORSOptions{
193-
AllowedMethods: "POST",
194-
AllowedHeaders: "Content-Type, Authorization",
196+
AllowedMethods: []string{"POST"},
197+
AllowedHeaders: middleware.DefaultAllowedHeaders,
195198
AllowCredentials: true,
199+
MaxAge: 600,
196200
}
197201
mux.HandleFunc(middleware.WithCORS("POST /flows/{flowId}/restore", handler.restoreFlowVersion, opts4))
198202
mux.HandleFunc(middleware.WithCORS("OPTIONS /flows/{flowId}/restore",

0 commit comments

Comments
 (0)