Skip to content

Enable CORS for Code Interpreter Server #242

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mishushakov merged 2 commits into from
Mar 30, 2026
+13 −0
Merged

Enable CORS for Code Interpreter Server #242

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
091aa47
allow cors
mishushakov Mar 30, 2026
7517484
removed credentials true
mishushakov Mar 30, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions .changeset/stale-forks-lay.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
---
'@e2b/code-interpreter-template': patch
---

allow cors
9 changes: 9 additions & 0 deletions template/server/main.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@

from contextlib import asynccontextmanager
from fastapi import FastAPI, Request
from fastapi.middleware.cors import CORSMiddleware
from fastapi.responses import PlainTextResponse

from api.models.context import Context
Expand Down Expand Up @@ -58,8 +59,16 @@
raise


app = FastAPI(lifespan=lifespan)

app.add_middleware(
CORSMiddleware,
allow_origins=["*"],
allow_credentials=True,
Comment thread
mishushakov marked this conversation as resolved.
Outdated
allow_methods=["*"],
allow_headers=["*"],

Check failure on line 69 in template/server/main.py

View check run for this annotation

Claude / Claude Code Review

Invalid CORS config: wildcard origin with credentials=True 

The CORS middleware combines `allow_origins=["*"]` with `allow_credentials=True`, which is invalid per the CORS specification — browsers reject responses that send both `Access-Control-Allow-Origin: *` and `Access-Control-Allow-Credentials: true` for credentialed requests. Since authentication uses a custom `X-Access-Token` header (not a browser credential), `allow_credentials=True` is unnecessary and should be removed so the wildcard origin setting works correctly.
)
Comment thread
mishushakov marked this conversation as resolved.
Comment thread
mishushakov marked this conversation as resolved.

logger.info("Starting Code Interpreter server")


Expand Down
Loading