psa-systems/bunyip
8
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions

fix(cors): split CORS_ORIGIN comma-list into per-origin registrations #46

Merged
YousifShkara merged 1 commit from fix/cors-allowed-origins-list into main 2026-06-03 03:24:13 +02:00
Conversation 0 Commits 1 Files changed 1 +25 -7
YousifShkara commented 2026-06-03 03:24:02 +02:00
Owner
Copy link

The CorsLayer wiring assumed CORS_ORIGIN was a single absolute URL:

let cors_origin = config.cors_origin.clone(); // entire "https://a8n.systems,https://msp.a8n.systems,..." string
.allowed_origin(&cors_origin) // never matches a real Origin header
.split("://").nth(1).unwrap_or("") // yields "a8n.systems,https" on a comma-list

Once the bunyip-as-OP cutover landed three browser RPs (bunyip-web, mokosh-apps,
drillmark), the comma-list silently broke CORS for every cross-origin browser
hit to bunyip-api. The SPA's POST to /oauth2/token surfaced as a TypeError:
Failed to fetch on the /auth/callback page because the preflight had no
matching allowed origin.

Parse CORS_ORIGIN as comma-separated, register each entry via
cors.allowed_origin(o) in turn. Switch the subdomain-fallback domain derivation
to BUNYIP_WEB_ORIGIN (which is always a single URL) so the closure isn't fed
a comma-list either.

The CorsLayer wiring assumed CORS_ORIGIN was a single absolute URL: let cors_origin = config.cors_origin.clone(); // entire "https://a8n.systems,https://msp.a8n.systems,..." string .allowed_origin(&cors_origin) // never matches a real Origin header .split("://").nth(1).unwrap_or("") // yields "a8n.systems,https" on a comma-list Once the bunyip-as-OP cutover landed three browser RPs (bunyip-web, mokosh-apps, drillmark), the comma-list silently broke CORS for every cross-origin browser hit to bunyip-api. The SPA's POST to /oauth2/token surfaced as a TypeError: Failed to fetch on the /auth/callback page because the preflight had no matching allowed origin. Parse CORS_ORIGIN as comma-separated, register each entry via cors.allowed_origin(o) in turn. Switch the subdomain-fallback domain derivation to BUNYIP_WEB_ORIGIN (which is always a single URL) so the closure isn't fed a comma-list either.
fix(cors): split CORS_ORIGIN comma-list into per-origin registrations
All checks were successful
Create release / Create release from merged PR (pull_request) Has been skipped
Details
Check / fmt / clippy / build / test (pull_request) Successful in 1m8s
Details
66e9934406 
The CorsLayer wiring assumed CORS_ORIGIN was a single absolute URL:

  let cors_origin = config.cors_origin.clone();         // entire "https://a8n.systems,https://msp.a8n.systems,..." string
  .allowed_origin(&cors_origin)                          // never matches a real Origin header
  .split("://").nth(1).unwrap_or("")                    // yields "a8n.systems,https" on a comma-list

Once the bunyip-as-OP cutover landed three browser RPs (bunyip-web, mokosh-apps,
drillmark), the comma-list silently broke CORS for every cross-origin browser
hit to bunyip-api. The SPA's POST to /oauth2/token surfaced as a TypeError:
Failed to fetch on the /auth/callback page because the preflight had no
matching allowed origin.

Parse CORS_ORIGIN as comma-separated, register each entry via
cors.allowed_origin(o) in turn. Switch the subdomain-fallback domain derivation
to BUNYIP_WEB_ORIGIN (which is always a single URL) so the closure isn't fed
a comma-list either.
YousifShkara deleted branch fix/cors-allowed-origins-list 2026-06-03 03:24:13 +02:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
YousifShkara
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
psa-systems/bunyip!46
No description provided.