Merge pull request #258 from MISP/fix-cors-issues-prod

fix: add CORS_ORIGINS env var to add custom domains

Author: righel

.env.dev.dist

@@ -53,3 +53,6 @@ FLOWER_BASIC_AUTH=flower:flower
 
 # Logging level (DEBUG, INFO, WARNING, ERROR, CRITICAL)
 LOG_LEVEL=INFO
+
+# Comma-separated list of extra allowed CORS origins (e.g. https://app.example.com)
+CORS_ORIGINS=

.env.dist

@@ -47,4 +47,7 @@ GARAGE_METRICS_TOKEN=
 
 FLOWER_BASIC_AUTH=flower:flower
 
-LOG_LEVEL=WARNING
+LOG_LEVEL=WARNING
+
+# Comma-separated list of extra allowed CORS origins (e.g. https://app.misp-workbench.com)
+CORS_ORIGINS=

.env.test

@@ -48,4 +48,7 @@ GARAGE_METRICS_TOKEN=garage-test-metrics-token
 
 FLOWER_BASIC_AUTH=flower:flower
 
-LOG_LEVEL=DEBUG
+LOG_LEVEL=DEBUG
+
+# Comma-separated list of extra allowed CORS origins (e.g. https://app.example.com)
+CORS_ORIGINS=

CLAUDE.md

@@ -54,6 +54,13 @@ cd api && poetry run pre-commit run --all-files
 
 ### Frontend
 
+Copy `frontend/.env.dist` to `frontend/.env` and set `VITE_API_URL` to the API base URL before building:
+
+```bash
+cp frontend/.env.dist frontend/.env
+# Edit frontend/.env and set VITE_API_URL=https://api.your-domain.com
+```
+
 ```bash
 cd frontend
 npm install

README.md

@@ -43,7 +43,7 @@ Then start the stack:
 
 ```bash
 cp .env.dist .env
-# edit .env: set OAUTH2_SECRET_KEY, OAUTH2_REFRESH_SECRET_KEY, GARAGE_ADMIN_TOKEN, S3_ACCESS_KEY, S3_SECRET_KEY, etc.
+# edit .env: set CORS_ORIGINS, OAUTH2_SECRET_KEY, OAUTH2_REFRESH_SECRET_KEY, GARAGE_ADMIN_TOKEN, S3_ACCESS_KEY, S3_SECRET_KEY, etc.
 docker compose --env-file=".env" up --build
 ...
 ...

api/app/auth/auth.py

@@ -227,10 +227,7 @@ def get_scopes_for_user(user: user_schemas.User) -> list[str]:
 def get_random_password():
     return "".join(
         random.choice(
-            string.ascii_lowercase
-            + string.ascii_uppercase
-            + string.digits
-            + string.punctuation
+            string.ascii_lowercase + string.ascii_uppercase + string.digits
         )
-        for _ in range(12)
+        for _ in range(16)
     )

api/app/main.py

@@ -55,6 +55,9 @@
     "http://localhost:3001",
     "http://localhost:6274",
 ]
+extra_origins = os.environ.get("CORS_ORIGINS", "")
+if extra_origins:
+    origins += [o.strip() for o in extra_origins.split(",") if o.strip()]
 app.add_middleware(
     CORSMiddleware,
     allow_origins=origins,

api/app/tests/test_auth.py

@@ -135,10 +135,10 @@ def test_returns_empty_for_no_scopes(self):
 
 
 class TestGetRandomPassword:
-    def test_returns_string_of_length_12(self):
+    def test_returns_string_of_length_16(self):
         pwd = get_random_password()
         assert isinstance(pwd, str)
-        assert len(pwd) == 12
+        assert len(pwd) == 16
 
     def test_passwords_differ_across_calls(self):
         passwords = {get_random_password() for _ in range(10)}

api/entrypoint.sh

@@ -10,9 +10,10 @@ if [ "$STORAGE_ENGINE" = "s3" ]; then
 fi
 
 # create admin org and user (skipped if they already exist)
-ADMIN_PASSWORD=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c 24)
+ADMIN_PASSWORD=$(openssl rand -hex 16)
 poetry run python -m app.cli create-organisation ADMIN
-poetry run python -m app.cli create-user admin@admin.local "$ADMIN_PASSWORD" 1 1
+CREATE_USER_OUTPUT=$(poetry run python -m app.cli create-user admin@admin.local "$ADMIN_PASSWORD" 1 1)
+echo "$CREATE_USER_OUTPUT"
 
 cat <<'EOF'
 
@@ -25,8 +26,11 @@ cat <<'EOF'
 
   Server is ready!
 EOF
-echo "  Admin credentials:  admin@admin.local / $ADMIN_PASSWORD"
-echo
+if echo "$CREATE_USER_OUTPUT" | grep -q "Created user"; then
+  echo "  Admin credentials:  admin@admin.local / $ADMIN_PASSWORD"
+  echo "  Save this password — it will not be shown again."
+  echo
+fi
 
 # OpenSearch credentials (prod security plugin is enabled)
 export OPENSEARCH_USERNAME="${OPENSEARCH_USERNAME:-admin}"
@@ -36,4 +40,4 @@ export OPENSEARCH_PASSWORD="${OPENSEARCH_PASSWORD:-${OPENSEARCH_INITIAL_ADMIN_PA
 poetry run python -m app.opensearch_setup
 
 # start API
-poetry run uvicorn app.main:app --host 0.0.0.0 --port 80
+poetry run uvicorn app.main:app --host 0.0.0.0 --port 80 --proxy-headers --forwarded-allow-ips='*'

docker-compose.yml

@@ -38,6 +38,7 @@ x-environment: &default-env
   MAIL_PORT: ${MAIL_PORT}
   MAIL_SERVER: ${MAIL_SERVER}
   LOG_LEVEL: ${LOG_LEVEL:-INFO}
+  CORS_ORIGINS: ${CORS_ORIGINS:-}
 
 services:
   postgres: