Merge pull request #188 from flatironinstitute/restrict-CORS

Restrict CORS to known domains
flatironinstitute · Jul 31, 2024 · 49bfb94 · 49bfb94
2 parents b0c1f2e + d1b6fdb
commit 49bfb94
Showing 1 changed file with 8 additions and 3 deletions.
diff --git a/backend/stan-wasm-server/src/app/main.py b/backend/stan-wasm-server/src/app/main.py
@@ -51,14 +51,19 @@ def setup_logger() -> None:
 
 app.add_middleware(
     CORSMiddleware,
-    allow_origins=["*"],
+    allow_origins=[
+        "https://stan-playground.flatironinstitute.org",
+        "https://stan-playground.vercel.app",
+        "http://127.0.0.1:3000",  # yarn dev
+        "http://127.0.0.1:4173",  # yarn preview
+    ],
     allow_credentials=True,
     allow_methods=["*"],
     allow_headers=["*"],
 )
 
 
-##### Custom exception handlers
+# Custom exception handlers
 Exn = TypeVar("Exn", bound=Exception)
 
 
@@ -84,7 +89,7 @@ async def _(_request: Request, exc: Exception) -> JSONResponse:
     register_exn_handler(*e)
 
 
-##### Routing
+# Routing
 
 DictResponse = dict[str, Any]