server: allow to configure CORS_ORIGIN

server/reflector/app.py

@@ -1,13 +1,12 @@
 from contextlib import asynccontextmanager
 
+import reflector.auth  # noqa
+import reflector.db  # noqa
 from fastapi import FastAPI
 from fastapi.middleware.cors import CORSMiddleware
 from fastapi.routing import APIRoute
 from fastapi_pagination import add_pagination
 from prometheus_fastapi_instrumentator import Instrumentator
-
-import reflector.auth  # noqa
-import reflector.db  # noqa
 from reflector.events import subscribers_shutdown, subscribers_startup
 from reflector.logger import logger
 from reflector.metrics import metrics_init
@@ -47,7 +46,7 @@ else:
 app = FastAPI(lifespan=lifespan)
 app.add_middleware(
     CORSMiddleware,
-    allow_origins=["*"],
+    allow_origins=settings.CORS_ORIGIN.split(","),
     allow_methods=["*"],
     allow_headers=["*"],
 )

server/reflector/settings.py

@@ -6,6 +6,9 @@ class Settings(BaseSettings):
 
     OPENMP_KMP_DUPLICATE_LIB_OK: bool = False
 
+    # CORS
+    CORS_ORIGIN: str = "*"
+
     # Database
     DATABASE_URL: str = "sqlite:///./reflector.sqlite3"