From f2c00bb39a5d22e03e5937d68a3dc64588fed1d3 Mon Sep 17 00:00:00 2001 From: DavidHLP Date: Sun, 5 Jul 2026 11:41:45 +0800 Subject: [PATCH] fix(cors): make prod compose CORS_ALLOWED_ORIGINS required (fail-closed) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The previous default ${CORS_ALLOWED_ORIGINS:-http://localhost:9002,http://localhost:9003} let production silently fall back to localhost origins if the operator forgot to set the var — anyone running a local :9002/:9003 page could then call the prod API with the user's cookie. Production fail-open. Switch to ${CORS_ALLOWED_ORIGINS:?... is required}, matching the existing fail-closed pattern used 10x in this file (NACOS_PASSWORD, DB_PASSWORD, REDIS_PASSWORD, JWT_SECRET, ...). Dev fallback stays in .env.example:36 (dev reads .env, never this prod compose default). Fixes #102 --- docker-compose.prod.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml index 7fcdafb39..c89198a5f 100644 --- a/docker-compose.prod.yml +++ b/docker-compose.prod.yml @@ -83,7 +83,7 @@ services: - NACOS_USERNAME=${NACOS_USERNAME:?NACOS_USERNAME is required} - NACOS_PASSWORD=${NACOS_PASSWORD:?NACOS_PASSWORD is required} - SERVER_PORT=9001 - - CORS_ALLOWED_ORIGINS=${CORS_ALLOWED_ORIGINS:-http://localhost:9002,http://localhost:9003} + - CORS_ALLOWED_ORIGINS=${CORS_ALLOWED_ORIGINS:?CORS_ALLOWED_ORIGINS is required} depends_on: mysql: condition: service_healthy