Conversation
Walkthrough이번 PR은 SecurityConfig 클래스의 corsConfigurationSource 메서드를 수정하여 CORS 구성의 허용 출처 목록을 업데이트합니다. 기존에 허용되던 "https://aics-auth.ummdev.com"에 더해 새로운 출처 "https://aics-client-dev.vercel.app/"가 추가되어, 두 출처 모두 CORS 요청에 대해 허용되도록 변경되었습니다. Changes
Possibly related PRs
Suggested reviewers
✨ Finishing Touches
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
Test Coverage Report
|
Codecov ReportAll modified and coverable lines are covered by tests ✅ @@ Coverage Diff @@
## develop #200 +/- ##
==========================================
Coverage 92.99% 92.99%
Complexity 129 129
==========================================
Files 48 48
Lines 371 371
Branches 4 4
==========================================
Hits 345 345
Misses 21 21
Partials 5 5 Continue to review full report in Codecov by Sentry.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🔭 Outside diff range comments (1)
aics-common/src/main/java/kgu/developers/common/config/SecurityConfig.java (1)
91-93: CORS 보안 설정 강화가 필요합니다.현재 모든 헤더와 메소드를 허용하는 것(
"*")은 보안상 위험할 수 있습니다. 필요한 헤더와 메소드만 명시적으로 허용하는 것이 좋습니다.다음과 같이 수정하는 것을 제안드립니다:
- config.setAllowedHeaders(Collections.singletonList("*")); - config.setAllowedMethods(Collections.singletonList("*")); + config.setAllowedHeaders(Arrays.asList( + "Authorization", + "Content-Type", + "Accept" + )); + config.setAllowedMethods(Arrays.asList( + "GET", + "POST", + "PUT", + "DELETE", + "OPTIONS" + ));
🧹 Nitpick comments (1)
aics-common/src/main/java/kgu/developers/common/config/SecurityConfig.java (1)
88-106: 환경별 CORS 설정 분리를 고려해보세요.개발, 스테이징, 프로덕션 환경에 따라 허용되는 오리진이 다를 수 있습니다. 환경 변수나 프로필을 통해 이를 관리하는 것이 좋습니다.
예시:
@Value("${cors.allowed-origins}") private String[] allowedOrigins; CorsConfigurationSource corsConfigurationSource() { return request -> { CorsConfiguration config = new CorsConfiguration(); // ... other configurations ... config.setAllowedOriginPatterns(Arrays.asList(allowedOrigins)); return config; }; }application.yml:
cors: allowed-origins: - http://localhost:3000 - https://aics-auth.ummdev.com - https://aics-client-dev.vercel.app
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
aics-common/src/main/java/kgu/developers/common/config/SecurityConfig.java(1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms (1)
- GitHub Check: build-docker-image
| "https://aics-auth.ummdev.com", | ||
| "https://aics-client-dev.vercel.app/" |
There was a problem hiding this comment.
🛠️ Refactor suggestion
URL 형식의 일관성 개선이 필요합니다.
새로 추가된 URL에 trailing slash가 포함되어 있어 기존 URL들과 형식이 일치하지 않습니다.
다음과 같이 수정하는 것을 제안드립니다:
"https://aics-auth.ummdev.com",
- "https://aics-client-dev.vercel.app/"
+ "https://aics-client-dev.vercel.app"📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| "https://aics-auth.ummdev.com", | |
| "https://aics-client-dev.vercel.app/" | |
| "https://aics-auth.ummdev.com", | |
| "https://aics-client-dev.vercel.app" |
Summary
CORS 이슈를 픽스 합니다.
Tasks