Skip to content

fix(cors): allow cross-origin API calls only from configured origins #42

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
danilovid merged 2 commits into from
Aug 28, 2026
Merged

fix(cors): allow cross-origin API calls only from configured origins #42

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ed566f7
fix(cors): allow cross-origin API calls only from configured origins
danilovid Aug 18, 2026
330aaef
refactor(config): parse comma separated flags via flag.Value
danilovid Aug 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion cluster-manager/cmd/cluster-manager/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -166,7 +166,7 @@ func main() {
}()
log.Info().Msgf("gRPC server listening at %v", lis.Addr())

httpSrv, err := server.New(cfg.ListenHTTPAddr, cfg.ListenGRPCAddr, tlsConfig)
httpSrv, err := server.New(cfg.ListenHTTPAddr, cfg.ListenGRPCAddr, tlsConfig, cfg.CORSAllowedOrigins)
if err != nil {
log.Fatal().Msgf("### Can't setup HTTP server: %v", err)
}
Expand Down
47 changes: 25 additions & 22 deletions cluster-manager/pkg/config/config.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,28 +8,29 @@ import (

// Config represents system configuration.
type Config struct {
NewDB bool // forces recreation of DB
PostgresAddr string // Postgres address in host[:port] format
PostgresDB string // Postgres db name
PostgresUser string // Postgres user
PostgresPassword string // Postgres password
PostgresSSLMode bool // Postgres SSL mode
PostgresSSLCheckCert bool // Check postgres SSL cert
AdministratorUsername string // Administrator user
AdministratorPassword string // Administrator password
LogLevel string // log level can be INFO, WARN, ERROR, FATAL, DEBUG or ALL
LogFile string // path to log file
ListenGRPCAddr string // address "[host]:port" that server should be listening on
ListenHTTPAddr string // address "[host]:port" that server should be listening for health checks
InstrumentationAddr string // address "[host]:port" that instrumentation server should be listening for health checks and metrics
TLS bool // is TLS enabled?
TokenKey string // key for jwt token
EncryptionKey string // encryption key for child clusters
PublicAccessTokenSaltKey string // publicAccessTokenSaltKey key for public api service
Auth bool // is auth enabled?
OwnCSURL string // URL of current CS (http(s)://host[:port]).
GopsAddr string // gops listen address
CSVersion string // CS version
NewDB bool // forces recreation of DB
PostgresAddr string // Postgres address in host[:port] format
PostgresDB string // Postgres db name
PostgresUser string // Postgres user
PostgresPassword string // Postgres password
PostgresSSLMode bool // Postgres SSL mode
PostgresSSLCheckCert bool // Check postgres SSL cert
AdministratorUsername string // Administrator user
AdministratorPassword string // Administrator password
LogLevel string // log level can be INFO, WARN, ERROR, FATAL, DEBUG or ALL
CORSAllowedOrigins config.StringList // origins allowed to call the API cross-origin
LogFile string // path to log file
ListenGRPCAddr string // address "[host]:port" that server should be listening on
ListenHTTPAddr string // address "[host]:port" that server should be listening for health checks
InstrumentationAddr string // address "[host]:port" that instrumentation server should be listening for health checks and metrics
TLS bool // is TLS enabled?
TokenKey string // key for jwt token
EncryptionKey string // encryption key for child clusters
PublicAccessTokenSaltKey string // publicAccessTokenSaltKey key for public api service
Auth bool // is auth enabled?
OwnCSURL string // URL of current CS (http(s)://host[:port]).
GopsAddr string // gops listen address
CSVersion string // CS version
}

// New reads config from environment and returns pointer to a new Config.
Expand Down Expand Up @@ -59,6 +60,8 @@ func New() *Config {
flag.StringVar(&c.OwnCSURL, "ownCSURL", config.LookupEnvString("OWN_CS_URL", ""), "URL of current CS (http(s)://host[:port]).")
flag.StringVar(&c.InstrumentationAddr, "listenInstrumentationAddr", config.LookupEnvString("LISTEN_INSTRUMENTATION_ADDR", ":9090"), `Address in form of "[host]:port" that instrumentation HTTP server should be listening on.`)

config.StringListVar(&c.CORSAllowedOrigins, "corsAllowedOrigins", "CORS_ALLOWED_ORIGINS", "", "Comma separated list of origins allowed to call the API cross-origin. Empty value allows same-origin requests only.")

flag.Parse()

return c
Expand Down
15 changes: 4 additions & 11 deletions cluster-manager/pkg/server/server.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,6 @@ import (
"github.com/justinas/alice"
"github.com/prometheus/client_golang/prometheus"
"github.com/prometheus/client_golang/prometheus/promhttp"
"github.com/rs/cors"
"github.com/runtime-radar/runtime-radar/cluster-manager/api"
"github.com/runtime-radar/runtime-radar/lib/server/healthcheck"
"github.com/runtime-radar/runtime-radar/lib/server/middleware"
Expand All @@ -26,15 +25,15 @@ const (
)

// New constructs and configures new *http.Server capable of serving application and gRPC gateway endpoints.
func New(httpAddr, grpcAddr string, tlsConfig *tls.Config) (*http.Server, error) {
func New(httpAddr, grpcAddr string, tlsConfig *tls.Config, corsAllowedOrigins []string) (*http.Server, error) {
mux := http.NewServeMux()

gwMux, err := newGWMux(context.Background(), grpcAddr, tlsConfig)
if err != nil {
return nil, err
}

h := setupRouter(mux, gwMux)
h := setupRouter(mux, gwMux, corsAllowedOrigins)

s := &http.Server{
ReadTimeout: readTimeout,
Expand Down Expand Up @@ -65,19 +64,13 @@ func NewInstrumentation(listenAddress string, gatherer prometheus.Gatherer) *htt
}
}

func setupRouter(mux *http.ServeMux, gwMux *runtime.ServeMux) http.Handler {
func setupRouter(mux *http.ServeMux, gwMux *runtime.ServeMux, corsAllowedOrigins []string) http.Handler {
mux.Handle("/", gwMux)

corsOpts := cors.Options{
AllowedOrigins: []string{"*"},
AllowedMethods: []string{"GET", "POST", "PUT", "PATCH", "DELETE"},
AllowedHeaders: []string{"Origin", "Accept", "Content-Type", "X-Requested-With", "Authorization"},
}

h := alice.New(
middleware.Log,
middleware.Recovery,
cors.New(corsOpts).Handler,
middleware.CORS(corsAllowedOrigins, middleware.DefaultCORSHeaders),
).Then(mux)

return h
Expand Down
2 changes: 1 addition & 1 deletion cs-manager/cmd/cs-manager/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -198,7 +198,7 @@ func main() {
}()
log.Info().Msgf("gRPC server listening at %v", lis.Addr())

httpSrv, err := server.New(cfg.ListenHTTPAddr, cfg.ListenGRPCAddr, tlsConfig)
httpSrv, err := server.New(cfg.ListenHTTPAddr, cfg.ListenGRPCAddr, tlsConfig, cfg.CORSAllowedOrigins)
if err != nil {
log.Fatal().Msgf("### Can't setup HTTP server: %v", err)
}
Expand Down
51 changes: 27 additions & 24 deletions cs-manager/pkg/config/config.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,30 +9,31 @@ import (

// Config represents system configuration.
type Config struct {
NewDB bool // forces recreation of DB
PostgresAddr string // Postgres address in host[:port] format
PostgresDB string // Postgres db name
PostgresUser string // Postgres user
PostgresPassword string // Postgres password
PostgresSSLMode bool // Postgres SSL mode
PostgresSSLCheckCert bool // Check postgres SSL cert
LogLevel string // log level can be INFO, WARN, ERROR, FATAL, DEBUG or ALL
LogFile string // path to log file
ListenGRPCAddr string // address "[host]:port" that server should be listening on
ListenHTTPAddr string // address "[host]:port" that server should be listening for health checks
InstrumentationAddr string // address "[host]:port" that instrumentation server should be listening for health checks and metrics
TLS bool // is TLS enabled?
CSVersion string // CS version
TokenKey string // key for jwt token
Auth bool // is auth enabled?
GopsAddr string // gops listen address
IsChildCluster bool // is CS in child cluster
OwnCSURL string // URL of current CS
CentralCSURL string // URL of central CS
GrafanaURL string // URL to Grafana with CS metrics
CentralCSTLSCheckCert bool // Check central CS TLS certificate
RegistrationToken string // token of current cluster to register in central CS
RegistrationInterval time.Duration // interval for registration in central CS
NewDB bool // forces recreation of DB
PostgresAddr string // Postgres address in host[:port] format
PostgresDB string // Postgres db name
PostgresUser string // Postgres user
PostgresPassword string // Postgres password
PostgresSSLMode bool // Postgres SSL mode
PostgresSSLCheckCert bool // Check postgres SSL cert
LogLevel string // log level can be INFO, WARN, ERROR, FATAL, DEBUG or ALL
CORSAllowedOrigins config.StringList // origins allowed to call the API cross-origin
LogFile string // path to log file
ListenGRPCAddr string // address "[host]:port" that server should be listening on
ListenHTTPAddr string // address "[host]:port" that server should be listening for health checks
InstrumentationAddr string // address "[host]:port" that instrumentation server should be listening for health checks and metrics
TLS bool // is TLS enabled?
CSVersion string // CS version
TokenKey string // key for jwt token
Auth bool // is auth enabled?
GopsAddr string // gops listen address
IsChildCluster bool // is CS in child cluster
OwnCSURL string // URL of current CS
CentralCSURL string // URL of central CS
GrafanaURL string // URL to Grafana with CS metrics
CentralCSTLSCheckCert bool // Check central CS TLS certificate
RegistrationToken string // token of current cluster to register in central CS
RegistrationInterval time.Duration // interval for registration in central CS
}

// New reads config from environment and returns pointer to a new Config.
Expand Down Expand Up @@ -64,6 +65,8 @@ func New() *Config {
flag.DurationVar(&c.RegistrationInterval, "registrationInterval", config.LookupEnvDuration("REGISTRATION_INTERVAL", time.Minute*5), "Interval for registration in central CS.")
flag.StringVar(&c.InstrumentationAddr, "listenInstrumentationAddr", config.LookupEnvString("LISTEN_INSTRUMENTATION_ADDR", ":9090"), `Address in form of "[host]:port" that instrumentation HTTP server should be listening on.`)

config.StringListVar(&c.CORSAllowedOrigins, "corsAllowedOrigins", "CORS_ALLOWED_ORIGINS", "", "Comma separated list of origins allowed to call the API cross-origin. Empty value allows same-origin requests only.")

flag.Parse()

return c
Expand Down
15 changes: 4 additions & 11 deletions cs-manager/pkg/server/server.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,6 @@ import (
"github.com/justinas/alice"
"github.com/prometheus/client_golang/prometheus"
"github.com/prometheus/client_golang/prometheus/promhttp"
"github.com/rs/cors"
"github.com/runtime-radar/runtime-radar/cs-manager/api"
"github.com/runtime-radar/runtime-radar/lib/server/healthcheck"
"github.com/runtime-radar/runtime-radar/lib/server/middleware"
Expand All @@ -28,14 +27,14 @@ const (
)

// New constructs and configures new *http.Server capable of serving application and gRPC gateway endpoints.
func New(httpAddr, grpcAddr string, tlsConfig *tls.Config) (*http.Server, error) {
func New(httpAddr, grpcAddr string, tlsConfig *tls.Config, corsAllowedOrigins []string) (*http.Server, error) {
mux := http.NewServeMux()
gwMux, err := newGWMux(context.Background(), grpcAddr, tlsConfig)
if err != nil {
return nil, err
}

h := setupRouter(mux, gwMux)
h := setupRouter(mux, gwMux, corsAllowedOrigins)

s := &http.Server{
ReadTimeout: readTimeout,
Expand Down Expand Up @@ -68,19 +67,13 @@ func NewInstrumentation(listenAddress string, gatherer prometheus.Gatherer) *htt
}
}

func setupRouter(mux *http.ServeMux, gwMux *runtime.ServeMux) http.Handler {
func setupRouter(mux *http.ServeMux, gwMux *runtime.ServeMux, corsAllowedOrigins []string) http.Handler {
mux.Handle("/", gwMux)

corsOpts := cors.Options{
AllowedOrigins: []string{"*"},
AllowedMethods: []string{"GET", "POST", "PUT", "PATCH", "DELETE"},
AllowedHeaders: []string{"Origin", "Accept", "Content-Type", "X-Requested-With", "Authorization"},
}

h := alice.New(
middleware.Log,
middleware.Recovery,
cors.New(corsOpts).Handler,
middleware.CORS(corsAllowedOrigins, middleware.DefaultCORSHeaders),
).Then(mux)

return h
Expand Down
2 changes: 1 addition & 1 deletion event-processor/cmd/event-processor/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -225,7 +225,7 @@ func main() {
}()
log.Info().Msgf("gRPC server listening at %v", lis.Addr())

httpSrv, err := server.New(cfg.ListenHTTPAddr, cfg.ListenGRPCAddr, tlsConfig)
httpSrv, err := server.New(cfg.ListenHTTPAddr, cfg.ListenGRPCAddr, tlsConfig, cfg.CORSAllowedOrigins)
if err != nil {
log.Fatal().Msgf("### Can't setup HTTP server: %v", err)
}
Expand Down
63 changes: 33 additions & 30 deletions event-processor/pkg/config/config.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,36 +9,37 @@ import (

// Config represents system configuration.
type Config struct {
NewDB bool // forces recreation of DB
PostgresAddr string // Postgres address in host[:port] format
PostgresDB string // Postgres db name
PostgresUser string // Postgres user
PostgresPassword string // Postgres password
PostgresSSLMode bool // Postgres SSL mode
PostgresSSLCheckCert bool // Check postgres SSL cert
LogLevel string // log level can be INFO, WARN, ERROR, FATAL, DEBUG or ALL
LogFile string // path to log file
ListenGRPCAddr string // address "[host]:port" that server should be listening on
ListenHTTPAddr string // address "[host]:port" that server should be listening on
InstrumentationAddr string // address "[host]:port" that instrumentation server should be listening for health checks and metrics
TLS bool // is TLS enabled?
TokenKey string // key for jwt token
Auth bool // is auth enabled?
ConfigUpdateInterval time.Duration // interval for config periodic update check
RabbitAddr string // RabbitMQ address in host[:port] format
RabbitUser string // RabbitMQ user
RabbitPassword string // RabbitMQ password
RabbitRuntimeEventsQueue string // RabbitMQ queue name for consuming runtime events
RabbitRuntimeEventsQueuePrefetchCount int // RabbitMQ prefetch count when consuming runtime events
RabbitHistoryEventsQueue string // RabbitMQ queue name for publishing processed events
GopsAddr string // gops listen address
WorkersPoolSize int // how many workers will process the events in parallel, 0 means auto-adjust to available cpu cores (minimum 2)
JobsBufferSize int // how many events will be read and kept in memory when all workers are busy
DeployDir string // directory to load detectors from
PolicyEnforcerGRPCAddr string // Policy Enforcer address in host[:port] format
NotifierGRPCAddr string // Notifier address in host[:port] format
KubeManagerGRPCAddr string // Kube Manager address in host[:port] format
OwnCSURL string // URL of current CS (http(s)://host[:port]).
NewDB bool // forces recreation of DB
PostgresAddr string // Postgres address in host[:port] format
PostgresDB string // Postgres db name
PostgresUser string // Postgres user
PostgresPassword string // Postgres password
PostgresSSLMode bool // Postgres SSL mode
PostgresSSLCheckCert bool // Check postgres SSL cert
LogLevel string // log level can be INFO, WARN, ERROR, FATAL, DEBUG or ALL
CORSAllowedOrigins config.StringList // origins allowed to call the API cross-origin
LogFile string // path to log file
ListenGRPCAddr string // address "[host]:port" that server should be listening on
ListenHTTPAddr string // address "[host]:port" that server should be listening on
InstrumentationAddr string // address "[host]:port" that instrumentation server should be listening for health checks and metrics
TLS bool // is TLS enabled?
TokenKey string // key for jwt token
Auth bool // is auth enabled?
ConfigUpdateInterval time.Duration // interval for config periodic update check
RabbitAddr string // RabbitMQ address in host[:port] format
RabbitUser string // RabbitMQ user
RabbitPassword string // RabbitMQ password
RabbitRuntimeEventsQueue string // RabbitMQ queue name for consuming runtime events
RabbitRuntimeEventsQueuePrefetchCount int // RabbitMQ prefetch count when consuming runtime events
RabbitHistoryEventsQueue string // RabbitMQ queue name for publishing processed events
GopsAddr string // gops listen address
WorkersPoolSize int // how many workers will process the events in parallel, 0 means auto-adjust to available cpu cores (minimum 2)
JobsBufferSize int // how many events will be read and kept in memory when all workers are busy
DeployDir string // directory to load detectors from
PolicyEnforcerGRPCAddr string // Policy Enforcer address in host[:port] format
NotifierGRPCAddr string // Notifier address in host[:port] format
KubeManagerGRPCAddr string // Kube Manager address in host[:port] format
OwnCSURL string // URL of current CS (http(s)://host[:port]).
}

// New reads config from environment and returns pointer to a new Config.
Expand Down Expand Up @@ -76,6 +77,8 @@ func New() *Config {
flag.StringVar(&c.OwnCSURL, "ownCSURL", config.LookupEnvString("OWN_CS_URL", ""), "URL of current CS (http(s)://host[:port]).")
flag.StringVar(&c.InstrumentationAddr, "listenInstrumentationAddr", config.LookupEnvString("LISTEN_INSTRUMENTATION_ADDR", ":9090"), `Address in form of "[host]:port" that instrumentation HTTP server should be listening on.`)

config.StringListVar(&c.CORSAllowedOrigins, "corsAllowedOrigins", "CORS_ALLOWED_ORIGINS", "", "Comma separated list of origins allowed to call the API cross-origin. Empty value allows same-origin requests only.")

flag.Parse()

return c
Expand Down
Loading
Loading