-
Notifications
You must be signed in to change notification settings - Fork 40
Cors configuration for Identity api service #101
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. Weβll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change | ||
|---|---|---|---|---|
|
|
@@ -18,3 +18,6 @@ tm-url=@TM_API@ | |||
|
|
||||
| # FHIR Config | ||||
| fhir-url=@FHIR_API@ | ||||
| logging.file.name=@env.IDENTITY_API_1097_LOGGING_FILE_NAME@ | ||||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Remove duplicate property definition. The Apply this diff to remove the duplicate: -logging.file.name=@env.IDENTITY_API_1097_LOGGING_FILE_NAME@π Committable suggestion
Suggested change
π€ Prompt for AI Agents |
||||
|
|
||||
| cors.allowed-origins=@env.CORS_ALLOWED_ORIGINS | ||||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -14,4 +14,5 @@ logging.file.name=logs/1097identity-api.log | |
| tm-url=http://localhost:8089/ | ||
|
|
||
| # FHIR Config | ||
| fhir-url=http://localhost:8093/ | ||
| fhir-url=http://localhost:8093/ | ||
| cors.allowed-origins= | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π οΈ Refactor suggestion Provide a meaningful default or document expected format. An empty -cors.allowed-origins=
+# cors.allowed-origins=https://example.com,https://localhost:3000
+cors.allowed-origins=Or provide a safe default: -cors.allowed-origins=
+cors.allowed-origins=http://localhost:3000π€ Prompt for AI Agents |
||
| Original file line number | Diff line number | Diff line change | ||
|---|---|---|---|---|
|
|
@@ -18,3 +18,6 @@ tm-url=@TM_API@ | |||
|
|
||||
| # FHIR Config | ||||
| fhir-url=@FHIR_API@ | ||||
| logging.file.name=@env.IDENTITY_API_LOGGING_FILE_NAME@ | ||||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Remove duplicate logging configuration. The -logging.file.name=@env.IDENTITY_API_LOGGING_FILE_NAME@π Committable suggestion
Suggested change
π€ Prompt for AI Agents |
||||
|
|
||||
| cors.allowed-origins=@env.CORS_ALLOWED_ORIGINS | ||||
| Original file line number | Diff line number | Diff line change | ||||||
|---|---|---|---|---|---|---|---|---|
|
|
@@ -13,4 +13,5 @@ logging.file.name=logs/identity-api.log | |||||||
| tm-url=http://localhost:8089/ | ||||||||
|
|
||||||||
| # FHIR Config | ||||||||
| fhir-url=http://localhost:8093/ | ||||||||
| fhir-url=http://localhost:8093/ | ||||||||
| cors.allowed-origins=* | ||||||||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. π οΈ Refactor suggestion Security concern: Overly permissive CORS configuration. The wildcard For production use, replace the wildcard with specific domains: -cors.allowed-origins=*
+cors.allowed-origins=https://yourtrustedomain.com,https://anothertrustedomain.comπ Committable suggestion
Suggested change
π€ Prompt for AI Agents |
||||||||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,25 @@ | ||
| package com.iemr.common.identity.config; | ||
|
|
||
| import org.springframework.beans.factory.annotation.Value; | ||
| import org.springframework.context.annotation.Configuration; | ||
| import org.springframework.web.servlet.config.annotation.CorsRegistry; | ||
| import org.springframework.web.servlet.config.annotation.WebMvcConfigurer; | ||
|
|
||
| @Configuration | ||
| public class CorsConfig implements WebMvcConfigurer { | ||
|
|
||
| @Value("${cors.allowed-origins}") | ||
| private String allowedOrigins; | ||
|
|
||
| @Override | ||
| public void addCorsMappings(CorsRegistry registry) { | ||
| registry.addMapping("/**") | ||
| .allowedOriginPatterns(allowedOrigins.split(",")) | ||
| .allowedMethods("GET", "POST", "PUT", "DELETE", "OPTIONS") | ||
| .allowedHeaders("*") | ||
| .exposedHeaders("Authorization", "Jwttoken") // Explicitly expose headers if needed | ||
| .allowCredentials(true) | ||
| .maxAge(3600) | ||
| ; | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Fix semicolon formatting. The semicolon placement violates coding standards and is flagged by the pipeline. Apply this fix: - .maxAge(3600)
- ;
+ .maxAge(3600);π§° Toolsπͺ GitHub Actions: CodeQL[warning] 23-23: ';' is preceded with whitespace. πͺ GitHub Actions: Package[warning] 23-23: Checkstyle warning: ';' is preceded with whitespace. π€ Prompt for AI Agents |
||
| } | ||
| } | ||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
π‘ Verification agent
π§© Analysis chain
Verify dependency versions for security and compatibility.
The Jersey (2.30.1) and JAXB (2.3.1) versions appear outdated and may contain security vulnerabilities or compatibility issues with Spring Boot 3.2.2.
π Web query:
π‘ Result:
Latest Stable Versions
Jersey Media JSON Processing
jersey-media-json-processing(as of May 2025) is 3.1.10, released in January 2025[1][3]. There is also a 4.0.0-M2 milestone release, but 3.1.10 is the newest stable (non-milestone) version[3].Glassfish JAXB Runtime
jaxb-runtime, the most recent version in the 2.x series is 2.3.9. However, specific references above relate only to version 2.3.1 and some older versions, so you may want to check repositories such as Maven Central directly for any 3.x versions if you need the absolute latest. But 2.3.1 is a widely used and stable release in the 2.x line[6].Security Vulnerabilities
Jersey Media JSON Processing 2.30.1
JAXB Runtime 2.3.1
glassfish-jaxb-runtime2.3.1, none of the sources above list known vulnerabilities specifically targeting this version[9]. The vulnerabilities referenced pertain to older 2.2.x releases, and there are no CVE records implicating 2.3.1, based on Snykβs data[9]. As with all dependencies, especially Java XML libraries, keep watch for any new XXE or serialization issues and regularly check for updates.Summary Table
Conclusion:
Citations:
Upgrade Jersey and JAXB dependencies
Jersey 2.30.1 and JAXB 2.3.1 are functional but outdated. The latest stable versions are Jersey 3.1.10 and JAXB 2.3.9. No CVEs are reported for the current versions, but upgrading ensures you get the newest fixes, features, and optimal compatibility with Spring Boot 3.2.2.
Locations to update:
Proposed diff:
π Committable suggestion
π€ Prompt for AI Agents