Add fixes#34
Conversation
…or production URL
Merge pull request IFRI-AI-Classes#33 from Pinite37/main
There was a problem hiding this comment.
Pull request overview
This PR adjusts the application startup defaults and simplifies CORS configuration for the FastAPI app under backup/, aiming to align runtime behavior with the intended deployment environment.
Changes:
- Update
start.shdefaults (worker count, frontend URL env var) and change howSECRET_KEYis provided. - Replace dynamic/validated CORS origin building in
backup/app/main.pywith a static allow-list including the configured production frontend URL.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| start.sh | Changes runtime defaults and environment variables used at launch (workers, frontend URL, SECRET_KEY). |
| backup/app/main.py | Simplifies CORS allow-list construction by hardcoding origins and appending FRONTEND_PROD_URL. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
|
||
|
|
||
| ALLOWED_ORIGINS = _build_allowed_origins() | ||
| ALLOWED_ORIGINS = ["http://localhost:3000", "http://127.0.0.1:3000", "https://ifri-ai-classes.github.io", FRONTEND_PROD_URL] |
There was a problem hiding this comment.
ALLOWED_ORIGINS currently always includes localhost origins and appends FRONTEND_PROD_URL even when it is an empty string. This broadens CORS in production and can also introduce an invalid origin entry. Consider rebuilding this list from environment configuration, filtering out falsy/invalid values, and only including localhost origins in dev/test.
| # Require stable secret key in environments with external users. | ||
| # Generate and export a fresh SECRET_KEY at launch time. | ||
| export SECRET_KEY="$(python -c "import secrets; print(secrets.token_urlsafe(32))")" | ||
| export SECRET_KEY="X2ZlC8ezhVReYCer02s7TdwRT10epQMjwZVKAFwTOE4" | ||
| if [[ -z "${SECRET_KEY:-}" ]]; then | ||
| echo "ERROR: SECRET_KEY is required. Set it in your environment before starting the server." >&2 |
There was a problem hiding this comment.
Hardcoding SECRET_KEY in the repo is a security issue and also makes the subsequent "SECRET_KEY is required" check ineffective (it can never be empty). Prefer reading SECRET_KEY from the environment/secret manager (and failing fast if missing), and avoid committing real secrets to version control. Also update/remove the nearby comment that says a fresh key is generated at launch, since the script now sets a fixed value.
No description provided.