aljaz/Auto-GPT
1
0
Fork 0
mirror of https://github.com/aljazceru/Auto-GPT.git synced 2025-12-18 22:44:21 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix(agent/security): Make CORS more restrictive and configurable

Browse Source 
* By default, allow requests originating from http://localhost:{AP_SERVER_PORT} instead of all origins
* Allow configuring allowed CORS origins through `AP_SERVER_CORS_ALLOWED_ORIGINS`
This commit is contained in:
Reinier van der Leer
2024-02-28 21:14:49 +01:00
parent 1881f4f7cd
commit ce45c9b267
2 changed files with 10 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
autogpts/autogpt/.env.template
View File

@@ -232,6 +232,8 @@ OPENAI_API_KEY=your-openai-api-key
### Agent Protocol Server Settings ### Agent Protocol Server Settings
################################################################################ ################################################################################
## AP_SERVER_PORT - Specifies what port the agent protocol server will listen on. (Default: 8000) ## AP_SERVER_PORT - Specifies what port the agent protocol server will listen on. (Default: 8000)
## AP_SERVER_DB_URL - Specifies what connection url the agent protocol database will connect to (Default: Internal SQLite)
## AP_SERVER_CORS_ALLOWED_ORIGINS - Comma separated list of allowed origins for CORS. (Default: http://localhost:{AP_SERVER_PORT})
# AP_SERVER_PORT=8000 # AP_SERVER_PORT=8000
# # AP_SERVER_DB_URL - Specifies what connection url the agent protocol database will connect to (Default: Internal SQLite)
# AP_SERVER_DB_URL=sqlite:///data/ap_server.db # AP_SERVER_DB_URL=sqlite:///data/ap_server.db
# AP_SERVER_CORS_ALLOWED_ORIGINS=

11
autogpts/autogpt/autogpt/app/agent_protocol_server.py
View File

@@ -74,11 +74,14 @@ class AgentProtocolServer:
version="v0.4", version="v0.4",
) )
# Add CORS middleware # Configure CORS middleware
origins = [ default_origins = [f"http://localhost:{port}"] # Default only local access
"*", configured_origins = [
# Add any other origins you want to whitelist origin
for origin in os.getenv("AP_SERVER_CORS_ALLOWED_ORIGINS", "").split(",")
if origin # Empty list if not configured
] ]
origins = configured_origins or default_origins
app.add_middleware( app.add_middleware(
CORSMiddleware, CORSMiddleware,