Skip to content

infra: CORS regex for Vercel preview deploys (OPE-56) #272

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
DevanshuNEU merged 2 commits into from
Mar 1, 2026
Merged

infra: CORS regex for Vercel preview deploys (OPE-56) #272

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
8b97d27
infra: add ALLOW_ORIGIN_REGEX for Vercel preview deploy CORS (OPE-56)
DevanshuNEU Mar 1, 2026
afa7755
fix: scope CORS regex to project name, not all Vercel apps
DevanshuNEU Mar 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions .env.example
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,6 +40,9 @@ GITHUB_REDIRECT_URI=http://localhost:3000/auth/github/callback
# CORS Configuration (Security)
# Comma-separated list of allowed origins
ALLOWED_ORIGINS=http://localhost:3000
# Regex for dynamic CORS origins (Vercel preview deploys)
# Scoped to our project name so only our previews can call the backend
# ALLOW_ORIGIN_REGEX=https://opencodeintel.*\.vercel\.app

# Redis (auto-configured in Docker, set REDIS_URL in Railway)
REDIS_HOST=redis
Expand Down
2 changes: 2 additions & 0 deletions backend/config/startup_checks.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,8 @@
("GITHUB_CLIENT_ID", "GitHub OAuth client ID", "GitHub repo import disabled"),
("GITHUB_CLIENT_SECRET", "GitHub OAuth client secret", "GitHub repo import disabled"),
("DISCORD_FEEDBACK_WEBHOOK", "Discord webhook for feedback", "Feedback notifications disabled"),
("ALLOW_ORIGIN_REGEX", "CORS regex for preview deploys", "Only explicit origins allowed"),
("GITHUB_TOKEN", "GitHub API token for repo analysis", "Using unauthenticated rate limit (60/hr)"),
]


Expand Down
4 changes: 4 additions & 0 deletions backend/main.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,9 +75,13 @@ async def dispatch(self, request: Request, call_next):
app.add_middleware(RequestSizeLimitMiddleware)

ALLOWED_ORIGINS = os.getenv("ALLOWED_ORIGINS", "http://localhost:3000").split(",")
# Allow Vercel preview deploys so PRs can be tested against prod backend.
# Set to project-scoped regex: https://opencodeintel.*\.vercel\.app
ALLOW_ORIGIN_REGEX = os.getenv("ALLOW_ORIGIN_REGEX", "")
app.add_middleware(
CORSMiddleware,
allow_origins=ALLOWED_ORIGINS,
allow_origin_regex=ALLOW_ORIGIN_REGEX or None,
allow_credentials=True,
allow_methods=["GET", "POST", "PUT", "DELETE", "OPTIONS"],
allow_headers=["Authorization", "Content-Type"],
Expand Down