gitea-admin/gh-christianlouis-docuelevate
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(api): configure CORS middleware for API endpoints

Browse Source 
- Add CORSMiddleware (disabled by default, enabled via CORS_ENABLED=true)
- Add cors_enabled, cors_allowed_origins, cors_allow_credentials,
  cors_allowed_methods, cors_allowed_headers settings to config.py
- Add parse_comma_separated_list validator for CORS list env vars
- Insert CORS middleware between SessionMiddleware and ProxyHeaders
  so preflight runs before CSRF/auth but after proxy-header processing
- Document CORS env vars in .env.demo with rationale for proxy-first approach
- Mark CORS TODO as completed in SECURITY_AUDIT.md
- Add tests/test_cors.py with 12 unit and integration tests

Closes #175

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
This commit is contained in:
copilot-swe-agent[bot]
2026-02-22 19:26:39 +00:00
parent 7a10f4a7c0
commit 1648d8c745
5 changed files with 328 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
SECURITY_AUDIT.md
+6 -2
View File
@@ -300,7 +300,11 @@ ftp = ftplib.FTP() # nosec B321 - Plaintext FTP intentional when configured
- Can be enabled for direct deployment without reverse proxy
- Individual header control and customization
- Documented in DeploymentGuide.md and ConfigurationGuide.md
- ⏳ **TODO:** Implement proper CORS configuration (currently not configured) ([#175](https://github.com/christianlouis/DocuElevate/issues/175))
- ✅ **CORS middleware implemented** - Configurable `CORSMiddleware` with allowed origins, methods, headers, and credentials ([#175](https://github.com/christianlouis/DocuElevate/issues/175))
- Disabled by default (typical deployment uses Traefik/Nginx reverse proxy that injects CORS headers)
- Enable via `CORS_ENABLED=true` for direct/standalone deployments without a reverse proxy
- Configurable via `CORS_ALLOWED_ORIGINS`, `CORS_ALLOW_CREDENTIALS`, `CORS_ALLOWED_METHODS`, `CORS_ALLOWED_HEADERS`
- Rationale documented in `.env.demo` and `DeploymentGuide.md`
- ✅ **Request logging with sensitive data masking implemented** ([#170](https://github.com/christianlouis/DocuElevate/issues/170))
- `AuditLogMiddleware` in `app/middleware/audit_log.py` logs every HTTP request
- Logs: method, path, status code, response time, client IP (configurable), username
@@ -319,7 +323,7 @@ ftp = ftplib.FTP() # nosec B321 - Plaintext FTP intentional when configured
### Medium Priority
1. ~~**Add security headers**~~ ✅ Implemented - Configurable HSTS, CSP, X-Frame-Options, X-Content-Type-Options middleware
2. **Configure CORS properly** - Currently no CORS middleware configured ([#175](https://github.com/christianlouis/DocuElevate/issues/175))
2. ~~**Configure CORS properly**~~ ✅ Implemented - `CORSMiddleware` disabled by default (Traefik/Nginx handles CORS in production); enable via `CORS_ENABLED=true` for direct deployments ([#175](https://github.com/christianlouis/DocuElevate/issues/175))
3. ~~**Implement audit logging**~~ ✅ Implemented - Request/audit logging with sensitive data masking ([#170](https://github.com/christianlouis/DocuElevate/issues/170))
4. ~~**Add file upload size limits**~~ ✅ Implemented - Configurable limits with 1GB default, optional file splitting
5. **Document security architecture** - Security design decisions