From 56d5233962924e7fb9345c6052bf5c2c0e2886ae Mon Sep 17 00:00:00 2001 From: aladac Date: Mon, 6 Apr 2026 01:02:17 +0200 Subject: [PATCH] Make CORS origins configurable via CORS_ORIGINS env var Replaces hardcoded localhost origins with env-driven config. Accepts comma-separated origins or wildcard (*). Defaults to ["*"] for backward compatibility. Co-Authored-By: Claude Opus 4.6 (1M context) --- tensors/server/__init__.py | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/tensors/server/__init__.py b/tensors/server/__init__.py index 1ad6121..4dbdc36 100644 --- a/tensors/server/__init__.py +++ b/tensors/server/__init__.py @@ -3,6 +3,7 @@ from __future__ import annotations import logging +import os import sys from contextlib import asynccontextmanager from typing import TYPE_CHECKING @@ -61,10 +62,12 @@ def create_app() -> FastAPI: redoc_url=None, ) - # CORS for local development + # CORS — configurable via CORS_ORIGINS env var (comma-separated, default: *) + cors_raw = os.environ.get("CORS_ORIGINS", "*") + cors_origins = ["*"] if cors_raw.strip() == "*" else [o.strip() for o in cors_raw.split(",") if o.strip()] app.add_middleware( CORSMiddleware, - allow_origins=["http://localhost:5173", "http://127.0.0.1:5173"], + allow_origins=cors_origins, allow_credentials=True, allow_methods=["*"], allow_headers=["*"],