farmcontrol/farmcontrol-api
2
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

Update CORS configuration in config.json and README.md to allow multiple origins. Refactor CORS handling in index.js to utilize new server.corsOrigins setting, enhancing API security and flexibility.

Browse Source
This commit is contained in:
Tom Butcher 2026-08-02 01:01:50 +01:00
parent 0dafdf1eda
commit 87256257d7
3 changed files with 18 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
README.md
View File

@ -155,7 +155,7 @@ The application uses Keycloak for authentication. Configure your Keycloak server
The application uses MongoDB. Ensure your MongoDB instance is running and accessible at the configured `DB_LINK`. The application uses MongoDB. Ensure your MongoDB instance is running and accessible at the configured `DB_LINK`.
### CORS Configuration ### CORS Configuration
The application is configured to allow requests only from the specified `APP_URL_CLIENT`. Update this in your environment configuration. Allowed request origins are configured via `server.corsOrigins` in `config.json`. When omitted, the API falls back to `app.urlClient` and `app.urlElectronClient`.
## 🚀 Deployment ## 🚀 Deployment

12
config.json
View File

@ -2,7 +2,14 @@
"development": { "development": {
"server": { "server": {
"port": 8787, "port": 8787,
"logLevel": "trace" "logLevel": "trace",
"corsOrigins": [
"https://web.farmcontrol.app",
"https://dev.tombutcher.work",
"http://localhost:5173",
"http://localhost:3000",
"http://localhost:5780"
]
}, },
"auth": { "auth": {
"enabled": true, "enabled": true,
@ -124,7 +131,8 @@
"production": { "production": {
"server": { "server": {
"port": 8080, "port": 8080,
"logLevel": "info" "logLevel": "info",
"corsOrigins": ["https://web.farmcontrol.app", "views://mainview"]
}, },
"auth": { "auth": {
"enabled": true, "enabled": true,

11
src/index.js
View File

@ -81,14 +81,15 @@ logger.level = config.server.logLevel;
app.use(log4js.connectLogger(logger, { level: 'trace' })); app.use(log4js.connectLogger(logger, { level: 'trace' }));
const whitelist = [config.app.urlClient, config.app.urlElectronClient]; const allowedOrigins =
config.server.corsOrigins ||
[config.app.urlClient, config.app.urlElectronClient].filter(Boolean);
const corsOptions = { const corsOptions = {
origin: function (origin, callback) { origin: function (origin, callback) {
if (!origin || whitelist.indexOf(origin) !== -1) { if (!origin) return callback(null, true);
callback(null, true); if (allowedOrigins.includes('*')) return callback(null, true);
} else { if (allowedOrigins.includes(origin)) return callback(null, true);
callback(new Error('Not allowed by CORS')); callback(new Error('Not allowed by CORS'));
}
}, },
credentials: true, credentials: true,
}; };