Repository navigation
Default CORS_ORIGINS omits the frontend dev server port 8080 — browser calls to the API are blocked #43
Description
Summary
api/config.py defaulted CORS_ORIGINS to http://localhost:5173,http://localhost:3000. The React frontend's Vite dev server (npm run dev / scripts/start-frontend.ps1, via @lovable.dev/vite-tanstack-config) listens on port 8080. So with default settings the browser's CORS preflight from http://localhost:8080 gets no Access-Control-Allow-Origin header, and every API call from the UI is blocked.
Impact
- A fresh local setup that follows the README (API on :8000, frontend on :8080) fails in the browser unless the developer knows to export
CORS_ORIGINSby hand.docs/QUICKSTART.mddocumented that workaround;env.dev.exampleanddocs/ENV_VARIABLES.mddid not. scripts/start-frontend.ps1also said the frontend runs onhttp://localhost:5173, which is wrong and adds to the confusion.
Steps to reproduce
- Start the API with no
CORS_ORIGINSset. - Send a preflight:
OPTIONS /api/csv/fileswithOrigin: http://localhost:8080andAccess-Control-Request-Method: GET. - Expected:
200withaccess-control-allow-origin: http://localhost:8080. - Actual:
400 Disallowed CORS origin, with no allow-origin header.
Notes
- Found while writing the accessibility and system-integration tests in Group tests into unit, system, SIT, performance, accessibility and UAT #41, which start the Vite dev server on its real port.
- Fix: add
http://localhost:8080to the default list, keeping5173and3000for other setups. Updateenv.dev.example,docs/ENV_VARIABLES.md, the README andstart-frontend.ps1to match. Production deployments still setCORS_ORIGINSexplicitly, so they are unaffected. - Fix commit:
15268aeon branchclaude/elegant-bohr-zn28zn(PR Group tests into unit, system, SIT, performance, accessibility and UAT #41).
Activity
test: regression tests for #42 (preview parse_failed) and #43 (CORS :…
amar-python commentedon Oct 10, 2026
Fixed and verified
Fix:
15268ae. The defaultCORS_ORIGINSinapi/config.pyis nowhttp://localhost:8080,http://localhost:5173,http://localhost:3000, so the Vite dev server's port is allowed and the old ports still work.env.dev.example,docs/ENV_VARIABLES.md,README.mdandscripts/start-frontend.ps1(which said 5173) are updated to match. Deployments that setCORS_ORIGINSexplicitly are unaffected.Regression tests
tests/unit/test_db_pool.py::test_cors_allows_frontend_dev_server_by_defaultOPTIONS /api/csv/filesfromOrigin: http://localhost:8080returns200withaccess-control-allow-origin: http://localhost:8080tests/unit/test_db_pool.py::test_cors_still_refuses_unlisted_origins(added in09ff668)http://evil.exampleis still400with no allow-origin headertests/unit/test_config_auth.py::TestSettings::test_defaultsCORS_ORIGINSunset, the default list is exactly[":8080", ":5173", ":3000"]on localhostThe tests catch the bug. Run against the pre-fix source (
15268ae~1)::8080returned400 'Disallowed CORS origin'with noaccess-control-allow-origin, which is the behaviour described above.FAILED test_cors_allows_frontend_dev_server_by_defaultandFAILED test_defaults.test_cors_still_refuses_unlisted_originspassed both before and after, as it should.They pass with the fix:
6f6814a(PR Group tests into unit, system, SIT, performance, accessibility and UAT #41, all 4 checks green):integration (postgres service)job:executed 392 · PASSED 392 · FAILED 0 · SKIPPED 0,RESULT: PASS. Only the 23 accessibility tests were not run in that job, so all three tests above passed there.free-tier(Linux) andpython-validator-tests(Windows) also ran the unit tests green.Note: the fix is on branch
claude/elegant-bohr-zn28znand reachesmainwhen PR #41 is merged.Closing as fixed.
Generated by Claude Code
Merge pull request #74 from amar-python/fix/issues-42-43-on-main