infra: CORS regex for Vercel preview deploys (OPE-56)#272
Conversation
Vercel preview deploys get dynamic URLs like: opencodeintel-git-feat-xxx.vercel.app These need to call the Railway backend but get CORS blocked because ALLOWED_ORIGINS only has the production domain. FastAPI CORSMiddleware supports allow_origin_regex -- now configurable via ALLOW_ORIGIN_REGEX env var. Set on Railway to: https://.*\.vercel\.app This allows all Vercel preview URLs to call the backend while keeping the explicit ALLOWED_ORIGINS list for production. Also added GITHUB_TOKEN to optional startup vars (used by /repos/analyze).
|
@DevanshuNEU is attempting to deploy a commit to the Dev's projects Team on Vercel. A member of the Team first needs to authorize it. |
📝 WalkthroughWalkthroughAdds optional environment-driven CORS regex support and a GitHub token option: updates Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
backend/main.py (1)
78-84: Consider restricting CORS regex to your specific Vercel project.The documented default pattern
https://.*\.vercel\.appallows any Vercel-hosted app to make cross-origin requests to your backend. While this enables all PR preview deploys to function, it's broader than necessary.For additional security, use a project-specific pattern:
https://opencodeintel-.*\.vercel\.appThis still supports dynamic branch/PR URLs while restricting access to your specific Vercel project.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@backend/main.py` around lines 78 - 84, The ALLOW_ORIGIN_REGEX default is too permissive; set ALLOW_ORIGIN_REGEX (used when calling app.add_middleware with CORSMiddleware and parameter allow_origin_regex) to a project-scoped pattern instead of the broad https://.*\.vercel\.app; update the environment default or validation so it uses something like https://opencodeintel-.*\.vercel\.app when empty, and ensure the add_middleware call still passes ALLOW_ORIGIN_REGEX or None (tied to the existing ALLOWED_ORIGINS variable) so only your Vercel project previews can access the backend.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In `@backend/main.py`:
- Around line 78-84: The ALLOW_ORIGIN_REGEX default is too permissive; set
ALLOW_ORIGIN_REGEX (used when calling app.add_middleware with CORSMiddleware and
parameter allow_origin_regex) to a project-scoped pattern instead of the broad
https://.*\.vercel\.app; update the environment default or validation so it uses
something like https://opencodeintel-.*\.vercel\.app when empty, and ensure the
add_middleware call still passes ALLOW_ORIGIN_REGEX or None (tied to the
existing ALLOWED_ORIGINS variable) so only your Vercel project previews can
access the backend.
https://.*\.vercel\.app is too broad -- allows any Vercel project to call our backend. Scoped to https://opencodeintel.*\.vercel\.app so only our preview deploys are allowed.
|
The latest updates on your projects. Learn more about Vercel for GitHub. 1 Skipped Deployment
|
There was a problem hiding this comment.
🧹 Nitpick comments (1)
.env.example (1)
43-45: Refine the CORS regex to match actual Vercel preview URL formats.The current pattern
https://opencodeintel.*\.vercel\.appis overly permissive. However, the recommended patternhttps://opencodeintel-[a-z0-9-]+\.vercel\.appis too restrictive and would reject legitimate Vercel preview URLs with dots or underscores in branch names (e.g.,opencodeintel-git-feature.new-staging.vercel.app).According to Vercel's documentation, preview URLs follow these formats:
- Per-commit:
<project>-<hash>-<scope>.vercel.app- Per-branch:
<project>-git-<branch>-<scope>.vercel.appConsider a more balanced pattern:
https://opencodeintel(-git-[a-z0-9._\/-]+)?-[a-z0-9._-]+\.vercel\.appThis accepts the actual structure while being more restrictive than
.*. Alternatively, document that the security model relies on Vercel's domain control and the uniqueness of the project name within the team's account, which naturally constrains which URLs can be assigned.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.env.example around lines 43 - 45, The ALLOW_ORIGIN_REGEX example is too permissive; replace the commented value for ALLOW_ORIGIN_REGEX with a balanced regex that matches Vercel preview URL formats (per-commit and per-branch) such as the suggested pattern accepting optional "-git-<branch>" segments and allowing dots/underscores in branch names, or update the comment to document that Vercel's domain control and the project name uniqueness are relied upon for security; ensure the variable name ALLOW_ORIGIN_REGEX is updated in the .env.example and the new pattern is shown as the recommended value.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In @.env.example:
- Around line 43-45: The ALLOW_ORIGIN_REGEX example is too permissive; replace
the commented value for ALLOW_ORIGIN_REGEX with a balanced regex that matches
Vercel preview URL formats (per-commit and per-branch) such as the suggested
pattern accepting optional "-git-<branch>" segments and allowing
dots/underscores in branch names, or update the comment to document that
Vercel's domain control and the project name uniqueness are relied upon for
security; ensure the variable name ALLOW_ORIGIN_REGEX is updated in the
.env.example and the new pattern is shown as the recommended value.
ℹ️ Review info
Configuration used: Repository UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
.env.examplebackend/main.py
🚧 Files skipped from review as they are similar to previous changes (1)
- backend/main.py
1 participant
Adds ALLOW_ORIGIN_REGEX env var so Vercel preview deploy URLs can call the Railway backend without CORS errors.
Set on Railway: ALLOW_ORIGIN_REGEX=https://.*.vercel.app
Partial progress on OPE-56.
Summary by CodeRabbit
New Features
Configuration