Skip to content

Update CORS Headers #963

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mbryzek merged 1 commit into from
Mar 2, 2026
Merged

Update CORS Headers #963

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions api/conf/base.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,14 @@ evolutionplugin=disabled

play.filters.cors.preflightMaxAge = 3 days
play.filters.cors.allowedHttpMethods = ["DELETE", "GET", "PATCH", "POST", "PUT", "OPTIONS"]
play.filters.cors.allowedHttpMethods = ["DELETE", "GET", "PATCH", "POST", "PUT", "OPTIONS"]
Copy link

Copilot AI Mar 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

play.filters.cors.allowedHttpMethods is defined twice with the same value. In HOCON the last assignment wins, but this duplication is confusing and can hide future changes—please remove the duplicate line and keep a single definition.

Suggested change
play.filters.cors.allowedHttpMethods = ["DELETE", "GET", "PATCH", "POST", "PUT", "OPTIONS"]

Copilot uses AI. Check for mistakes.
play.filters.cors.allowedOrigins = [
"https://app.apibuilder.io",
"https://app.apibuilder.org",
"http://localhost:5173"
]


Comment on lines +17 to +21
Copy link

Copilot AI Mar 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

base.conf is included by both production and dev/test configs, so allowing http://localhost:5173 here will also allow localhost origins in production. If localhost is only for local development, move it to devandtest.conf (or another non-production override) and keep base.conf production-safe.

Suggested change
"https://app.apibuilder.org",
"http://localhost:5173"
]
"https://app.apibuilder.org"
]

Copilot uses AI. Check for mistakes.
play.http.errorHandler = "io.apicollective.play.ErrorHandler"
play.http.filters = "io.apicollective.play.LoggingFilter"
play.http.parser.maxMemoryBuffer=10M
Expand Down
Loading