cd: #493: add CORS settings to allow call API requests from the local UI but for prod use strict settings limited to only prod domain and only used headers and method types

.devcontainer/devcontainer.json

@@ -24,5 +24,6 @@
 	},
 	"containerEnv": {
 		"API_ROOT_URL": "http://localhost:6503/api",
+		"CORS_ALLOWED_ORIGINS": "*"
 	}
 }

.github/workflows/.reusable-e2e-tests-against-prod.yml

@@ -32,4 +32,5 @@ jobs:
         "AUTH_FIRST_TENANT_LOGIN_WITH_ALL_PERMISSIONS": ${{ secrets.INNER_CIRCLE_PROD_AUTH_FIRST_TENANT_LOGIN_WITH_ALL_PERMISSIONS }}
         "AUTH_FIRST_TENANT_PASSWORD_WITH_ALL_PERMISSIONS": ${{ secrets.INNER_CIRCLE_PROD_AUTH_FIRST_TENANT_PASSWORD_WITH_ALL_PERMISSIONS }}
         "API_ROOT_URL": ${{ secrets.INNER_CIRCLE_PROD_AUTH_API_ROOT_URL }}
+        "CORS_ALLOWED_ORIGINS": ${{ secrets.INNER_CIRCLE_PROD_BASE_URL }}
         "SHOULD_USE_FAKE_EXTERNAL_DEPENDENCIES": "false"

.github/workflows/deploy-to-prod-from-default.yml

@@ -30,6 +30,7 @@ jobs:
             --state-values-set extraSecretEnvVars.InnerCircleServiceUrls__MailServiceUrl="${{ secrets.INNER_CIRCLE_PROD_MAIL_SERVICE_URL }}" \
             --state-values-set extraSecretEnvVars.InnerCircleServiceUrls__EmployeesServiceUrl="${{ secrets.INNER_CIRCLE_PROD_EMPLOYEES_SERVICE_URL }}" \
             --state-values-set extraSecretEnvVars.AuthenticationOptions__PublicSigningKey="${{ secrets.INNER_CIRCLE_PROD_PUBLIC_SIGNING_KEY }}" \
+            --state-values-set extraSecretEnvVars.CorsOptions__AllowedOrigins="${{ secrets.INNER_CIRCLE_PROD_BASE_URL }}" \
             --state-values-set extraSecretEnvVars.AuthenticationOptions__PrivateSigningKey="${{ secrets.INNER_CIRCLE_PROD_PRIVATE_SIGNING_KEY }}" > "/var/log/inner-circle/deploy/$(date +%F)-${{ github.event.repository.name }}-run-${{ github.run_id }}-job-${{ job.check_run_id }}.log" 2>&1
             # on the last line where we redirect output we don't add a line break for convenience because it is easy to make it wrong having an extra space after \ symbol which leads to exposure of logs to the public pipeline logs instead of the needed private file on a runner
 

.github/workflows/e2e-tests-on-pull-request.yml

@@ -60,4 +60,5 @@ jobs:
           "AUTH_FIRST_TENANT_PASSWORD_WITH_ALL_PERMISSIONS": "Serpens1!"
           "AUTH_API_ROOT_URL": "http://localhost:30090/api/auth"
           "API_ROOT_URL": "http://localhost:30090/api/auth"
+          "CORS_ALLOWED_ORIGINS": "*"
           "SHOULD_USE_FAKE_EXTERNAL_DEPENDENCIES": "false"

Api/CorsOptions.cs

@@ -0,0 +1,6 @@
+namespace Api;
+
+public class CorsOptions
+{
+    public required string AllowedOrigins { get; set; }
+}

Api/Program.cs

@@ -1,5 +1,6 @@
 using System.Reflection;
 using System.Runtime.InteropServices;
+using Api;
 using Api.Services;
 using Api.Services.Callbacks;
 using Api.Services.Options;
@@ -21,7 +22,6 @@
 const string defaultConnection = "DefaultConnection";
 
 builder.Services.AddControllers();
-builder.Services.AddCors();
 
 builder.Services.AddEndpointsApiExplorer();
 builder.Services.AddSwaggerGen();
@@ -92,7 +92,7 @@
   .AddRefreshConfidenceInterval()
   .AddLogout()
   .AddUserCredentialsValidator<UserCredentialsValidator>()
-  .WithUserClaimsProvider<UserClaimsProvider>(UserClaimsProvider.PermissionsClaimType);
+  .WithUserClaimsProvider<Api.Services.Users.UserClaimsProvider>(Api.Services.Users.UserClaimsProvider.PermissionsClaimType);
 
 builder.Services.AddIdentityCore<User>().AddDefaultTokenProviders();
 
@@ -127,12 +127,13 @@
 
 var app = builder.Build();
 
+var corsOptions = configuration.GetSection(nameof(CorsOptions)).Get<CorsOptions>();
+
 app.UseCors(
   corsPolicyBuilder => corsPolicyBuilder
-    .AllowAnyHeader()
-    .SetIsOriginAllowed(host => true)
-    .AllowAnyMethod()
-    .AllowAnyOrigin()
+      .WithOrigins(corsOptions!.AllowedOrigins)
+      .WithMethods("GET", "POST", "DELETE")
+      .WithHeaders("Authorization", "Content-Type")
 );
 
 if (app.Environment.IsEnvironment("Debug"))

Api/appsettings.MockForDevelopment.json

@@ -12,5 +12,8 @@
     "AuthUIServiceUrl": "https://localhost:3000",
     "AccountsServiceUrl": "http://localhost:5001",
     "EmployeesServiceUrl": "http://localhost:5006"
+  },
+  "CorsOptions": {
+    "AllowedOrigins": "*"
   }
 }

Api/appsettings.MockForPullRequest.json

@@ -12,5 +12,8 @@
     "AuthUIServiceUrl": "https://localhost:3000",
     "AccountsServiceUrl": "http://auth-api-mock-server:1080",
     "EmployeesServiceUrl": "http://auth-api-mock-server:1080"
+  },
+  "CorsOptions": {
+    "AllowedOrigins": "*"
   }
 }

Api/ci/helmfile.yaml

@@ -22,4 +22,5 @@ releases:
           InnerCircleServiceUrls__MailServiceUrl: "{{ .StateValues.extraSecretEnvVars.InnerCircleServiceUrls__MailServiceUrl }}"
           InnerCircleServiceUrls__AuthUIServiceUrl: "{{ .StateValues.extraSecretEnvVars.InnerCircleServiceUrls__AuthUIServiceUrl }}"
           InnerCircleServiceUrls__AccountsServiceUrl: "{{ .StateValues.extraSecretEnvVars.InnerCircleServiceUrls__AccountsServiceUrl }}"
+          CorsOptions__AllowedOrigins: "{{ .StateValues.extraSecretEnvVars.CorsOptions__AllowedOrigins }}"
           InnerCircleServiceUrls__EmployeesServiceUrl: "{{ .StateValues.extraSecretEnvVars.InnerCircleServiceUrls__EmployeesServiceUrl }}"

docker-compose.yml

@@ -84,6 +84,7 @@ services:
       API_ROOT_URL: "http://auth-api/api"
       AUTH_LOGIN: ${TEST_AUTH_LOGIN}
       AUTH_PASSWORD: ${TEST_AUTH_PASSWORD}
+      CORS_ALLOWED_ORIGINS: "*"
     networks:
       - auth-api-network
 

e2e/cors-settings.feature

@@ -0,0 +1,33 @@
+Feature: CORS Settings
+    # https://github.com/karatelabs/karate/issues/1191
+    # https://github.com/karatelabs/karate?tab=readme-ov-file#karate-fork
+
+  Background:
+    * header Content-Type = 'application/json'
+
+  Scenario: Verify API CORS settings
+
+    * def jsUtils = read('./js-utils.js')
+    * def authApiRootUrl = jsUtils().getEnvVariable('AUTH_API_ROOT_URL')
+    * def apiRootUrl = jsUtils().getEnvVariable('API_ROOT_URL')
+    * def authLogin = jsUtils().getEnvVariable('AUTH_FIRST_TENANT_LOGIN_WITH_ALL_PERMISSIONS')
+    * def authPassword = jsUtils().getEnvVariable('AUTH_FIRST_TENANT_PASSWORD_WITH_ALL_PERMISSIONS')
+    * def corsAllowedOrigins = jsUtils().getEnvVariable('CORS_ALLOWED_ORIGINS')
+
+    # Send CORS preflight OPTIONS request like UI does
+    Given url authApiRootUrl
+    And path '/login'
+    And request
+    """
+    {
+        "login": "#(authLogin)",
+        "password": "#(authPassword)"
+    }
+    """
+    And header Origin = corsAllowedOrigins
+    And header Access-Control-Request-Method = 'POST'
+    When method OPTIONS
+    Then status 204
+    And match responseHeaders["Access-Control-Allow-Origin"] == ["#(corsAllowedOrigins)"]
+    And match responseHeaders["Access-Control-Allow-Methods"] == ["GET,POST,DELETE"]
+    And match responseHeaders["Access-Control-Allow-Headers"] == ["Authorization,Content-Type"]