Middleware fix

Author: marcelomizuno

backend/app/api/routes/utils.py

@@ -31,16 +31,16 @@ async def health_check() -> bool:
     return True
 
 
-@router.get("/cors-debug", tags=["utils"], response_model=dict)
-def cors_debug() -> dict:
+@router.get("/cors-debug", tags=["utils"])
+def cors_debug():
     """
-    Endpoint for debugging CORS settings
+    Returns CORS configuration information for debugging.
     """
     from app.core.config import settings
 
     return {
-        "cors_origins": settings.BACKEND_CORS_ORIGINS,
+        "cors_origins": [str(origin) for origin in settings.BACKEND_CORS_ORIGINS],
         "all_cors_origins": settings.all_cors_origins,
         "frontend_host": settings.FRONTEND_HOST,
-        "environment": settings.ENVIRONMENT,
+        "environment": settings.ENVIRONMENT
     }

backend/app/core/middleware.py

@@ -1,73 +1,30 @@
 import logging
-from typing import Callable
+from typing import Callable, List
 
-from fastapi import FastAPI, Request, Response
-from starlette.middleware.base import BaseHTTPMiddleware
+from fastapi import FastAPI
 from starlette.middleware.cors import CORSMiddleware
-from starlette.types import ASGIApp
 
 from app.core.config import settings
 
 logger = logging.getLogger(__name__)
 
-
-class CustomCORSMiddleware(BaseHTTPMiddleware):
-    def __init__(
-        self,
-        app: ASGIApp,
-    ) -> None:
-        super().__init__(app)
-        self.allowed_origins = settings.all_cors_origins
-        logger.info(f"Configured CORS origins: {self.allowed_origins}")
-    
-    async def dispatch(self, request: Request, call_next: Callable) -> Response:
-        origin = request.headers.get("origin", "")
-        logger.info(f"Request from origin: {origin}")
-        
-        # Handle preflight OPTIONS requests explicitly
-        if request.method == "OPTIONS":
-            response = Response(status_code=200)
-            self._set_cors_headers(response, origin)
-            return response
-            
-        # For all other requests, continue with normal processing
-        response = await call_next(request)
-        
-        # Add CORS headers to response
-        self._set_cors_headers(response, origin)
-        
-        return response
-    
-    def _set_cors_headers(self, response: Response, origin: str) -> None:
-        if not origin:
-            return
-            
-        # Force add origin if in production environment
-        if settings.ENVIRONMENT != "local" and origin:
-            response.headers["Access-Control-Allow-Origin"] = origin
-            response.headers["Access-Control-Allow-Credentials"] = "true"
-            response.headers["Access-Control-Allow-Methods"] = "GET, POST, PUT, DELETE, OPTIONS"
-            response.headers["Access-Control-Allow-Headers"] = "Authorization, Content-Type, Accept"
-            response.headers["Access-Control-Max-Age"] = "3600"
-            logger.info(f"Added CORS headers for origin: {origin}")
-        elif origin in self.allowed_origins:
-            response.headers["Access-Control-Allow-Origin"] = origin
-            response.headers["Access-Control-Allow-Credentials"] = "true"
-            response.headers["Access-Control-Allow-Methods"] = "GET, POST, PUT, DELETE, OPTIONS"
-            response.headers["Access-Control-Allow-Headers"] = "Authorization, Content-Type, Accept"
-            response.headers["Access-Control-Max-Age"] = "3600"
-            logger.info(f"Added CORS headers for origin: {origin}")
-        else:
-            logger.warning(f"Origin not allowed: {origin}")
-
-
 def setup_cors(app: FastAPI) -> None:
-    """Configure CORS for the application."""
+    """
+    Configure CORS for the application - must be called before app startup.
+    """
+    origins = settings.all_cors_origins
 
-    # Remove any existing CORS middleware
-    app.middleware_stack = app.build_middleware_stack()
+    logger.info(f"Setting up CORS middleware with origins: {origins}")
 
-    # Add our custom CORS middleware
-    app.add_middleware(CustomCORSMiddleware)
+    # Add CORS middleware
+    app.add_middleware(
+        CORSMiddleware,
+        allow_origins=origins or ["*"],
+        allow_credentials=True,
+        allow_methods=["*"],
+        allow_headers=["*"],
+        expose_headers=["Content-Disposition"],
+        max_age=3600,
+    )
 
-    logger.info("Custom CORS middleware configured")
+    logger.info("CORS middleware configured")

backend/app/main.py

@@ -32,6 +32,10 @@ async def lifespan(app: FastAPI):
     title=settings.PROJECT_NAME, openapi_url=f"{settings.API_V1_STR}/openapi.json", lifespan=lifespan
 )
 
+# Debug logging for CORS origins
+origins = settings.all_cors_origins
+logger.info(f"CORS origins: {origins}")
+
 # Use our custom CORS middleware instead of the default FastAPI one
 setup_cors(app)