fix(security): remove localhost CORS origin, consolidate CORS in proxy by waleedlatif1 · Pull Request #4658 · simstudioai/sim

waleedlatif1 · 2026-05-19T02:20:45Z

Summary

Move all /api/* CORS handling from next.config.ts to proxy.ts so allowed origin is resolved per-request at runtime instead of baked at build time (which produced Access-Control-Allow-Origin: http://localhost:3000 with credentials: true in production)
Per-route policy table in proxy covers auth, MCP, form, and workflow execute endpoints; OPTIONS preflight short-circuited uniformly
Drop NEXT_PUBLIC_APP_URL build placeholder from Dockerfile (Zod has skipValidation: true; build path doesn't read it)
Remove 8 dead route OPTIONS handlers and their preflight tests now that the proxy handles preflight

Type of Change

Bug fix

Testing

Tested manually

Checklist

Code follows project style guidelines
Self-reviewed my changes
Tests added/updated and passing
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

vercel · 2026-05-19T02:20:52Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		May 19, 2026 6:42pm

gitguardian · 2026-05-19T02:20:52Z

️✅ There are no secrets present in this pull request anymore.

If these secrets were true positive and are still valid, we highly recommend you to revoke them.
While these secrets were previously flagged, we no longer have a reference to the
specific commits where they were detected. Once a secret has been leaked into a git
repository, you should consider it compromised, even if it was deleted immediately.
Find here more information about risks.

^{_{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}}

cursor · 2026-05-19T02:20:54Z

PR Summary

High Risk
High risk because it changes CORS behavior for all API endpoints and centralizes preflight handling in middleware, which can break cross-origin consumers if any policy rule is wrong. Also impacts embedded chat/form auth flows by changing how origins/credentials are set.

Overview
CORS handling is centralized at runtime in proxy.ts for all /api/* routes. A new rule-based resolveApiCorsPolicy applies per-path policies (OAuth2/JWKS/well-known, MCP Copilot, workflow execute, and embedded chat/form identifier routes) and uniformly short-circuits OPTIONS preflights, avoiding Next’s auto-OPTIONS path that would miss middleware headers.

Embedded chat/form API handlers (/api/chat/[identifier]/*, /api/form/[identifier]/*) and related OTP/SSO routes stop calling addCorsHeaders and rely on the proxy for CORS. Multiple explicit OPTIONS exports and their tests are removed from file, MCP, templates, tools image, and form routes; createOptionsResponse is deleted from api/files/utils.

next.config.ts drops build-time /api/* CORS header configuration (including credentialed origins), and the Docker build no longer injects a dummy NEXT_PUBLIC_APP_URL; a new proxy.test.ts covers the CORS policy matrix and the invariant that wildcard origin never pairs with credentials.

^{Reviewed by Cursor Bugbot for commit 5968f3b. Configure here.}

greptile-apps · 2026-05-19T02:26:14Z

Greptile Summary

This PR consolidates all /api/* CORS handling from build-time next.config.ts headers into a runtime middleware policy table in proxy.ts, fixing a production bug where NEXT_PUBLIC_APP_URL was baked at image build time and could produce Access-Control-Allow-Origin: http://localhost:3000 with credentials: true.

proxy.ts: Adds resolveApiCorsPolicy with per-route rules (OAuth2/JWKS/MCP → wildcard; embed chat/form paths → reflected origin; workflow execute → wildcard; workspace routes → APP_URL + credentials), a buildPreflightResponse helper that short-circuits OPTIONS uniformly, and applyCorsHeaders that sets Vary: Origin for all non-wildcard responses.
Route handlers (chat, form, files, MCP, templates, tools): Removes 8 dead OPTIONS exports and all addCorsHeaders call-sites now that the middleware is the single source of truth.
docker/app.Dockerfile: Drops the ARG/ENV NEXT_PUBLIC_APP_URL build placeholder; the proxy reads the value at runtime via getEnv() (dynamic process.env[key] access, bypassing Next.js build-time literal substitution).

Confidence Score: 5/5

Safe to merge. The change removes a production misconfiguration and replaces it with a well-tested runtime policy table with no regressions.

All addCorsHeaders call-sites and dead OPTIONS handlers are cleanly removed. The new resolveApiCorsPolicy covers every previously configured route, the embed path logic correctly guards reserved segments, and getEnv() dynamic lookup correctly reads NEXT_PUBLIC_APP_URL at runtime rather than build time.

No files require special attention.

Important Files Changed

Filename	Overview
apps/sim/proxy.ts	Core of the change: adds CORS policy table, resolveApiCorsPolicy, applyCorsHeaders, and buildPreflightResponse; API early-return correctly short-circuits before security filtering.
apps/sim/proxy.test.ts	New test suite with comprehensive coverage: wildcard routes, embed origin reflection, PUT in embed policy, reserved-segment exclusions, workflow execute rule, default credentialed policy, and the wildcard+credentials invariant.
apps/sim/lib/core/security/deployment.ts	Removes addCorsHeaders export; CORS now lives in proxy.ts. Clean removal with no residual references.
apps/sim/next.config.ts	Strips all /api/* CORS header blocks that baked NEXT_PUBLIC_APP_URL at build time; retains COEP/COOP overrides and security-header blocks for non-API routes.
docker/app.Dockerfile	Drops NEXT_PUBLIC_APP_URL build ARG/ENV; safe because proxy.ts uses getEnv() dynamic process.env access which reads the runtime value.

_{Reviews (4): Last reviewed commit: "fix(cors): allow PUT in embed CORS polic..." | Re-trigger Greptile}

Move all /api/* CORS handling from next.config.ts to proxy.ts so the runtime can resolve allowed origin per-request instead of baking it at build time (which produced "Access-Control-Allow-Origin: http://localhost:3000" with credentials:true in production). - proxy.ts: per-route CORS policy table covering auth, MCP, form, and workflow execute endpoints; OPTIONS preflight short-circuit; Vary: Origin when origin is not '*'; form routes defer to route handler's addCorsHeaders to avoid double-setting - next.config.ts: drop all /api/* Access-Control-Allow-* headers; keep COEP/COOP/CSP - deployment.ts: addCorsHeaders sets Vary: Origin alongside reflected Allow-Origin - Dockerfile: drop NEXT_PUBLIC_APP_URL build placeholder (Zod has skipValidation:true; build path doesn't read it) - Remove 8 dead OPTIONS handlers and their preflight tests now that the proxy handles preflight uniformly

…ruth Move CORS for /api/chat/* and /api/form/* into the proxy policy table with reflected-origin + credentials:false, and delete the per-route addCorsHeaders helper. Routes no longer set CORS headers — the proxy is the only writer. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

… tests Replace the if/else chain in resolveApiCorsPolicy with a CORS_RULES table so each route's policy lives in one place and is trivially scannable. Add proxy.test.ts covering each rule and the wildcard-with-credentials invariant. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

waleedlatif1 · 2026-05-19T18:19:10Z

@greptile

waleedlatif1 · 2026-05-19T18:19:14Z

@cursor review

The embed policy (reflected origin, credentials:false) was matching workspace-internal session-authed routes — /api/chat, /api/chat/manage/*, /api/chat/validate, and the form equivalents — which need the default credentialed policy. Tighten the matcher to the embed paths only and add tests covering the exclusion. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

The regex form `^/api/(chat|form)/(?!manage|validate)[^/]+(/(otp|sso))?$` was opaque on review and would silently exclude any future identifier subroute outside the hard-coded (otp|sso) group from the embed policy. Replace it with an imperative segment check and a named EMBED_RESERVED_SEGMENTS Set, so the policy boundary is visible at the top of the function and adding a reserved subpath is a one-line diff. Add a test asserting that future identifier subroutes also get the embed policy. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

waleedlatif1 · 2026-05-19T18:32:55Z

@greptile

waleedlatif1 · 2026-05-19T18:32:59Z

@cursor review

Both /api/chat/[identifier]/otp and /api/form/[identifier]/otp export PUT for OTP code verification. The embed policy advertised only GET/POST/OPTIONS, so cross-origin embed clients failed preflight on verify. Add PUT and assert it in the embed policy test. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

waleedlatif1 · 2026-05-19T18:44:33Z

@greptile

waleedlatif1 · 2026-05-19T18:44:37Z

@cursor review

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 5968f3b. Configure here.}

#4665) * fix(docker): restore NEXT_PUBLIC_APP_URL build arg with dummy fallback getBaseUrl() in lib/core/utils/urls is evaluated at module load during next build's page-data collection and throws if NEXT_PUBLIC_APP_URL is unset. PR #4658 removed the build arg, breaking the Docker build at the "/_not-found" page-data collection step. Restore the dummy localhost fallback (mirroring DATABASE_URL). The CORS fix from #4658 is preserved: next.config.ts no longer reads NEXT_PUBLIC_APP_URL at build time, and no module-level expression captures getBaseUrl() — every caller invokes it at request time, where getEnv() reads the deployed container env. The dummy localhost value cannot leak into runtime CORS response headers. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * chore(docker): trim verbose comment on build-time env args Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>

vercel Bot deployed to Preview May 19, 2026 02:24 View deployment

greptile-apps Bot reviewed May 19, 2026

View reviewed changes

Comment thread apps/sim/proxy.ts Outdated

Comment thread apps/sim/proxy.ts

Comment thread apps/sim/proxy.ts

waleedlatif1 changed the base branch from staging to main May 19, 2026 02:32

vercel Bot temporarily deployed to Preview May 19, 2026 02:36 Inactive

waleedlatif1 changed the base branch from main to staging May 19, 2026 02:37

waleedlatif1 force-pushed the waleedlatif1/csp-localhost-review branch from d8b6cfa to e168fab Compare May 19, 2026 02:39

vercel Bot deployed to Preview May 19, 2026 02:43 View deployment

vercel Bot temporarily deployed to Preview May 19, 2026 17:29 Inactive

vercel Bot temporarily deployed to Preview May 19, 2026 18:16 Inactive

cursor Bot reviewed May 19, 2026

View reviewed changes

Comment thread apps/sim/proxy.ts

vercel Bot temporarily deployed to Preview May 19, 2026 18:26 Inactive

vercel Bot temporarily deployed to Preview May 19, 2026 18:29 Inactive

greptile-apps Bot reviewed May 19, 2026

View reviewed changes

Comment thread apps/sim/proxy.ts

cursor Bot reviewed May 19, 2026

View reviewed changes

Comment thread apps/sim/proxy.ts

vercel Bot temporarily deployed to Preview May 19, 2026 18:42 Inactive

cursor Bot reviewed May 19, 2026

View reviewed changes

waleedlatif1 merged commit ef14b2b into staging May 19, 2026
14 checks passed

waleedlatif1 deleted the waleedlatif1/csp-localhost-review branch May 19, 2026 19:04

waleedlatif1 mentioned this pull request May 19, 2026

fix(docker): restore NEXT_PUBLIC_APP_URL build arg with dummy fallback #4665

Merged

2 tasks

waleedlatif1 mentioned this pull request May 19, 2026

v0.6.86: gemini 3.5 flash, wiza integration, CORS cleanup, railway and new relic integrations #4666

Merged

Conversation

waleedlatif1 commented May 19, 2026

Summary

Type of Change

Testing

Checklist

Uh oh!

vercel Bot commented May 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gitguardian Bot commented May 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

️✅ There are no secrets present in this pull request anymore.

Uh oh!

cursor Bot commented May 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

greptile-apps Bot commented May 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Uh oh!

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented May 19, 2026

Uh oh!

waleedlatif1 commented May 19, 2026

Uh oh!

Uh oh!

waleedlatif1 commented May 19, 2026

Uh oh!

waleedlatif1 commented May 19, 2026

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented May 19, 2026

Uh oh!

waleedlatif1 commented May 19, 2026

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

vercel Bot commented May 19, 2026 •

edited

Loading

gitguardian Bot commented May 19, 2026 •

edited

Loading

cursor Bot commented May 19, 2026 •

edited

Loading

greptile-apps Bot commented May 19, 2026 •

edited

Loading