fix(kueueviz): use wildcard for CORS allowed origins in development mode

yankay · yankay · commit 85540ce924ec · 2025-08-19T09:24:51.000Z
Signed-off-by: Kay Yan &lt;kay.yan@daocloud.io&gt;
diff --git a/cmd/kueueviz/backend/README.md b/cmd/kueueviz/backend/README.md
@@ -41,10 +41,12 @@ KUEUE_VIZ_PORT=8181 ./kueue_ws_app
 
 ## Variables
 
-| Environment variables | Description              | Default value |
-| --------------------- | ------------------------ | ------------- |
-| `KUEUE_VIZ_PORT`      | Default application port | 8080          |
-| `GIN_MODE`            | Gin mode                 | debug         |
+
+| Environment variables      | Description                          | Default value |
+| -------------------------- | ------------------------------------ | ------------- |
+| `KUEUE_VIZ_PORT`           | Default application port             | 8080          |
+| `GIN_MODE`                 | Gin mode                             | debug         |
+| `KUEUEVIZ_ALLOWED_ORIGINS` | Comma-separated list of CORS origins | `*` (dev only)|
 
 ## Endpoints
 
diff --git a/cmd/kueueviz/backend/middleware/cors.go b/cmd/kueueviz/backend/middleware/cors.go
@@ -31,6 +31,11 @@ import (
 
 // validateOrigin validates and sanitizes a CORS origin URL
 func validateOrigin(origin string) (string, bool) {
+	// Special case for wildcard origin
+	if origin == "*" {
+		return "*", true
+	}
+
 	u, err := url.Parse(origin)
 	if err != nil {
 		return "", false
@@ -44,6 +49,7 @@ func validateOrigin(origin string) (string, bool) {
 		return "", false
 	}
 
+	// Only include scheme and host (which includes port if specified)
 	cleanOrigin := fmt.Sprintf("%s://%s", u.Scheme, u.Host)
 	return cleanOrigin, true
 }
@@ -70,10 +76,7 @@ func ConfigureCORS() (cors.Config, error) {
 	} else {
 		// Default development origins (only in development mode)
 		if gin.Mode() != gin.ReleaseMode {
-			allowedOrigins = []string{
-				"http://localhost:3000",
-				"http://127.0.0.1:3000",
-			}
+			allowedOrigins = append(allowedOrigins, "*")
 			log.Println("KUEUEVIZ_ALLOWED_ORIGINS not set, using default development origins")
 		} else {
 			log.Println("Production mode: KUEUEVIZ_ALLOWED_ORIGINS must be explicitly set")
