-
Notifications
You must be signed in to change notification settings - Fork 2
Open
Labels
enhancementNew feature or requestNew feature or request
Description
Summary
Remove the need for CORS exceptions by updating logic to treat servers as a proxy
Motivation
Currently, the frontend (graphcap_studio) makes direct API calls to backend services (media_server, data_service, inference_bridge) using their respective URLs (http://localhost:32400, http://localhost:32550, http://localhost:32100). This architecture requires Cross-Origin Resource Sharing (CORS) configuration on all backend services to allow requests from the frontend domain.
This approach creates several problems:
- Security vulnerabilities by having overly permissive CORS settings (origin: '*')
- Configuration complexity across multiple services
- Browser compatibility issues with certain CORS implementations
- Cache invalidation challenges requiring cache-busting parameters
- Cross-origin resource blocking in some browsers
By implementing a proxy approach through the frontend's server, we can eliminate these issues and simplify the architecture.
Proposed Changes
- Modify the vite.config.ts file to add a proxy configuration
- Modify service clients to use relative urls if we don't have rpc set up already
- Remove Environment Variables for Direct Server URLs
- Update Docker Configuration to ensure comms are constrained to network
- Remove CORS Configuration from Backend Services
Impact
- Eliminates broad CORS permissions and potential security vulnerabilities
- Allows for more granular control over API access
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
enhancementNew feature or requestNew feature or request