Conversation
WalkthroughCORS 설정에 새로운 허용 출처 "https://local.wego.monster"를 추가했습니다. Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~5 minutes
Possibly related issues
Possibly related PRs
Poem
Pre-merge checks and finishing touches❌ Failed checks (3 warnings)
✅ Passed checks (2 passed)
✨ Finishing touches
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
github-project-automation
bot
moved this from In progress
to Done
in WeGo-Together Backend
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
src/main/java/team/wego/wegobackend/common/config/CorsConfig.java(1 hunks)src/main/java/team/wego/wegobackend/common/security/SecurityConfig.java(1 hunks)
| "https://api.wego.monster", | ||
| "https://local.wego.monster" |
There was a problem hiding this comment.
새로운 출처 추가는 적절하나, CORS 설정 중복 문제가 있습니다.
https://local.wego.monster 출처를 추가한 것은 양호하지만, SecurityConfig.java에서도 동일한 CORS 설정을 CorsConfigurationSource 빈으로 정의하고 있습니다. Spring Security가 활성화된 경우 SecurityConfig의 CORS 설정이 우선 적용되므로, 현재 CorsConfig 클래스의 설정은 무시될 수 있습니다.
CORS 설정을 SecurityConfig로 통합하여 단일 진실 공급원(Single Source of Truth)을 유지하는 것을 권장합니다.
다음과 같이 CorsConfig 클래스를 제거하고 SecurityConfig의 CORS 설정만 사용하도록 리팩터링하는 것을 고려하세요:
-@Configuration
-public class CorsConfig {
- @Bean
- public WebMvcConfigurer corsConfigurer() {
- return new WebMvcConfigurer() {
- @Override
- public void addCorsMappings(CorsRegistry registry) {
- registry.addMapping("/**")
- .allowedOrigins(
- "http://localhost:3000",
- "https://wego.monster",
- "https://api.wego.monster",
- "https://local.wego.monster"
- )
- .allowedMethods("GET", "POST", "PUT", "DELETE", "OPTIONS")
- .allowedHeaders("*")
- .allowCredentials(true)
- .maxAge(3600);
- }
- };
- }
-}또는 SecurityConfig에서 CORS 설정을 제거하고 이 파일만 사용하려면, SecurityConfig의 .cors() 설정을 제거해야 합니다.
Committable suggestion skipped: line range outside the PR's diff.
| "https://api.wego.monster", | ||
| "https://local.wego.monster")); |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# First, find the SecurityConfig.java file
find . -name "SecurityConfig.java" -type fRepository: WeGo-Together/WeGo_BackEnd
Length of output: 143
🏁 Script executed:
#!/bin/bash
# Search for application configuration files
fd -e yml -e yaml -e properties | grep -E "application.*\.(yml|yaml|properties)" | head -20Repository: WeGo-Together/WeGo_BackEnd
Length of output: 104
🏁 Script executed:
#!/bin/bash
# Read SecurityConfig.java to see the CORS configuration around lines 72-73
wc -l ./src/main/java/team/wego/wegobackend/common/security/SecurityConfig.javaRepository: WeGo-Together/WeGo_BackEnd
Length of output: 146
🏁 Script executed:
#!/bin/bash
# Check for profile-based application configuration files
fd "application-.*\.(yml|yaml|properties)" src/main/resources/Repository: WeGo-Together/WeGo_BackEnd
Length of output: 52
🏁 Script executed:
#!/bin/bash
# Read SecurityConfig.java from line 60 onwards to see lines 72-73 in context
sed -n '60,83p' ./src/main/java/team/wego/wegobackend/common/security/SecurityConfig.javaRepository: WeGo-Together/WeGo_BackEnd
Length of output: 901
🏁 Script executed:
#!/bin/bash
# Read application.yml to check current CORS configuration
cat src/main/resources/application.ymlRepository: WeGo-Together/WeGo_BackEnd
Length of output: 1943
🏁 Script executed:
#!/bin/bash
# Search for all references to local.wego.monster in the codebase
rg "local\.wego\.monster" -C 2Repository: WeGo-Together/WeGo_BackEnd
Length of output: 1291
🏁 Script executed:
#!/bin/bash
# Search for any local development setup documentation
fd -e md -e txt -e properties | xargs rg -l "local|localhost|development" | head -10Repository: WeGo-Together/WeGo_BackEnd
Length of output: 52
🏁 Script executed:
#!/bin/bash
# Read CorsConfig.java to see the other CORS configuration
cat src/main/java/team/wego/wegobackend/common/config/CorsConfig.javaRepository: WeGo-Together/WeGo_BackEnd
Length of output: 1164
🏁 Script executed:
#!/bin/bash
# Check for any documentation or comments about why there are two CORS configurations
rg -B 5 "CorsConfigurationSource|WebMvcConfigurer" src/main/java/team/wego/wegobackend/common/ | head -40Repository: WeGo-Together/WeGo_BackEnd
Length of output: 3618
🏁 Script executed:
#!/bin/bash
# Search for any references or imports to these CORS configs in other files
rg "CorsConfig|corsConfigurationSource" --type java | grep -v "^Binary"Repository: WeGo-Together/WeGo_BackEnd
Length of output: 1281
두 CORS 설정 파일의 하드코딩된 로컬 도메인을 환경별 설정으로 분리가 필요합니다.
https://local.wego.monster를 허용 출처에 추가했으나, 다음 문제들이 있습니다:
-
코드 중복: 동일한 도메인 목록이
SecurityConfig.java와CorsConfig.java두 파일에 하드코딩되어 있습니다. 둘 다 동일하게 수정해야 하며, 추후 유지보수 시에도 일관성 유지가 어렵습니다. -
환경별 설정 분리 부재: 로컬 개발용 도메인을 프로덕션 코드에 하드코딩하는 것은 권장되지 않습니다.
application.yml의 프로파일별 설정을 통해 환경에 따라 다른 허용 출처를 구성해야 합니다. -
로컬 HTTPS 도메인 검증: 일반적으로 로컬 개발은
http://localhost또는http://127.0.0.1을 사용하며, HTTPS는 인증서 설정이 필요합니다.https://local.wego.monster도메인이 실제로 로컬 개발 환경에서 접근 가능한지 확인이 필요합니다.
권장 수정 사항:
CorsConfig.java와 SecurityConfig.java 모두에서 하드코딩된 도메인 목록을 제거하고, 대신 설정 파일에서 주입받도록 변경하세요:
application.yml:
cors:
allowed-origins:
- http://localhost:3000
- https://wego.monster
- https://api.wego.monsterapplication-local.yml:
cors:
allowed-origins:
- http://localhost:3000
- https://wego.monster
- https://api.wego.monster
- https://local.wego.monsterCorsConfig.java와 SecurityConfig.java:
@Value("${cors.allowed-origins}")
private List<String> allowedOrigins;🤖 Prompt for AI Agents
In src/main/java/team/wego/wegobackend/common/security/SecurityConfig.java
around lines 72-73 (and likewise update CorsConfig.java), remove the hardcoded
origin strings and instead load allowed origins from configuration; add a
cors.allowed-origins list to application.yml and application-local.yml (local
profile includes the extra local origin), inject it into both SecurityConfig and
CorsConfig (e.g. @Value or @ConfigurationProperties into a List<String>) and use
that list when building the CORS and security origin checks so environments
control allowed origins and duplication is eliminated.
There was a problem hiding this comment.
Pull request overview
This PR adds a new allowed origin https://local.wego.monster to the CORS configuration to enable cross-origin requests from this subdomain.
- Added
https://local.wego.monsterto the list of allowed CORS origins - Updated both SecurityConfig and CorsConfig to maintain consistency
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| src/main/java/team/wego/wegobackend/common/security/SecurityConfig.java | Added https://local.wego.monster to the allowed origins list in the Spring Security CORS configuration |
| src/main/java/team/wego/wegobackend/common/config/CorsConfig.java | Added https://local.wego.monster to the allowed origins list in the WebMvc CORS configuration |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| "https://wego.monster", | ||
| "https://api.wego.monster")); | ||
| "https://api.wego.monster", | ||
| "https://local.wego.monster")); |
There was a problem hiding this comment.
The domain "https://local.wego.monster" suggests a local development environment. Consider whether this subdomain should be allowed in production. If this is intended only for local development, you might want to use environment-specific configuration (e.g., via application-{profile}.yml) to prevent exposing this origin in production environments.
| "https://api.wego.monster", | ||
| "https://local.wego.monster" |
There was a problem hiding this comment.
The domain "https://local.wego.monster" suggests a local development environment. Consider whether this subdomain should be allowed in production. If this is intended only for local development, you might want to use environment-specific configuration (e.g., via application-{profile}.yml) to prevent exposing this origin in production environments.
| "https://api.wego.monster", | |
| "https://local.wego.monster" | |
| "https://api.wego.monster" |
1 participant
📝 Pull Request
📌 PR 종류
해당하는 항목에 체크해주세요.
✨ 변경 내용
프론트 개발 환경 url 또한 CORS 등록을 원하는 요청을 처리하기 위해 URL을 추가합니다.
🔍 관련 이슈
🧪 테스트
변경된 기능에 대한 테스트 범위 또는 테스트 결과를 작성해주세요.
🚨 확인해야 할 사항 (Checklist)
PR을 제출하기 전에 아래 항목들을 확인해주세요.
🙋 기타 참고 사항
리뷰어가 참고하면 좋을 만한 추가 설명이 있다면 적어주세요.