The CORS middleware used AllowedOrigins: []string{"*"} with AllowCredentials: false, which prevents cross-origin cookie-based auth. This PR:
Adds UPAAS_CORS_ORIGINS env var (comma-separated origins)
Defaults to same-origin only (no CORS headers when unconfigured)
When configured, allows specified origins with AllowCredentials: true
Adds CORSOrigins field to config.Config
Also includes gofmt fixes for pre-existing formatting issues.
Test Results (before fix — build failure)
# git.eeqj.de/sneak/upaas/internal/middleware
internal/middleware/cors_test.go:19:5: unknown field CORSOrigins in struct literal of type config.Config
FAIL
Test Results (after fix)
=== RUN TestCORS_NoOriginsConfigured_NoCORSHeaders
--- PASS: TestCORS_NoOriginsConfigured_NoCORSHeaders (0.00s)
=== RUN TestCORS_OriginsConfigured_AllowsMatchingOrigin
--- PASS: TestCORS_OriginsConfigured_AllowsMatchingOrigin (0.00s)
=== RUN TestCORS_OriginsConfigured_RejectsNonMatchingOrigin
--- PASS: TestCORS_OriginsConfigured_RejectsNonMatchingOrigin (0.00s)
PASS
Lint Results
golangci-lint run --config .golangci.yml ./internal/middleware/
0 issues.
Note: 7 pre-existing gosec issues in other files remain (not introduced by this PR).
## Summary
The CORS middleware used `AllowedOrigins: []string{"*"}` with `AllowCredentials: false`, which prevents cross-origin cookie-based auth. This PR:
- Adds `UPAAS_CORS_ORIGINS` env var (comma-separated origins)
- Defaults to same-origin only (no CORS headers when unconfigured)
- When configured, allows specified origins with `AllowCredentials: true`
- Adds `CORSOrigins` field to `config.Config`
Also includes gofmt fixes for pre-existing formatting issues.
## Test Results (before fix — build failure)
```
# git.eeqj.de/sneak/upaas/internal/middleware
internal/middleware/cors_test.go:19:5: unknown field CORSOrigins in struct literal of type config.Config
FAIL
```
## Test Results (after fix)
```
=== RUN TestCORS_NoOriginsConfigured_NoCORSHeaders
--- PASS: TestCORS_NoOriginsConfigured_NoCORSHeaders (0.00s)
=== RUN TestCORS_OriginsConfigured_AllowsMatchingOrigin
--- PASS: TestCORS_OriginsConfigured_AllowsMatchingOrigin (0.00s)
=== RUN TestCORS_OriginsConfigured_RejectsNonMatchingOrigin
--- PASS: TestCORS_OriginsConfigured_RejectsNonMatchingOrigin (0.00s)
PASS
```
## Lint Results
```
golangci-lint run --config .golangci.yml ./internal/middleware/
0 issues.
```
Note: 7 pre-existing gosec issues in other files remain (not introduced by this PR).
Closes #40
sneak
was assigned by clawbot2026-02-19 22:45:43 +01:00
- Add CORSOrigins config field (UPAAS_CORS_ORIGINS env var)
- Default to same-origin only (no CORS headers when unconfigured)
- When configured, allow specified origins with AllowCredentials: true
- Add tests for CORS middleware behavior
Important security fix — replacing AllowedOrigins: ["*"] with explicit origin allowlist and enabling AllowCredentials: true. The old config was dangerous (wildcard + credentials is blocked by browsers, but the intent was wrong).
The implementation is clean: no origins configured = no CORS headers (strict same-origin). Good.
One note: the PR also includes whitespace/alignment changes across several files (routes.go, models/app.go, deploy.go). These are fine but could have been a separate commit for cleaner history.
LGTM.
Important security fix — replacing `AllowedOrigins: ["*"]` with explicit origin allowlist and enabling `AllowCredentials: true`. The old config was dangerous (wildcard + credentials is blocked by browsers, but the intent was wrong).
The implementation is clean: no origins configured = no CORS headers (strict same-origin). Good.
One note: the PR also includes whitespace/alignment changes across several files (routes.go, models/app.go, deploy.go). These are fine but could have been a separate commit for cleaner history.
LGTM.
sneak
merged commit b47f871412 into main2026-02-20 05:11:33 +01:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
clawbot
Summary
The CORS middleware used
AllowedOrigins: []string{"*"}withAllowCredentials: false, which prevents cross-origin cookie-based auth. This PR:UPAAS_CORS_ORIGINSenv var (comma-separated origins)AllowCredentials: trueCORSOriginsfield toconfig.ConfigAlso includes gofmt fixes for pre-existing formatting issues.
Test Results (before fix — build failure)
Test Results (after fix)
Lint Results
Note: 7 pre-existing gosec issues in other files remain (not introduced by this PR).
Closes #40
Important security fix — replacing
AllowedOrigins: ["*"]with explicit origin allowlist and enablingAllowCredentials: true. The old config was dangerous (wildcard + credentials is blocked by browsers, but the intent was wrong).The implementation is clean: no origins configured = no CORS headers (strict same-origin). Good.
One note: the PR also includes whitespace/alignment changes across several files (routes.go, models/app.go, deploy.go). These are fine but could have been a separate commit for cleaner history.
LGTM.