mirror of
https://github.com/Zproger/Aurum.git
synced 2026-10-13 02:56:39 +07:00
b045d378f0
`AURUM_CORS_ORIGINS` defaults to `*`, and the middleware was configured with
`allow_credentials=True`. Starlette does not answer that combination with a
literal `*` — it echoes back whatever `Origin` the caller sent and adds
`Access-Control-Allow-Credentials: true`, so any page open in the same
browser can call the instance, with the user's Basic Auth attached, and read
the response:
GET /api/accounts Origin: https://evil.example
-> Access-Control-Allow-Origin: https://evil.example
Access-Control-Allow-Credentials: true
That undercuts the README's advice that leaving Basic Auth off is fine while
the instance is only reachable from localhost: reachable-from-localhost
includes every website the user visits.
Nothing in the shipped setup is cross-origin. Compose serves the UI and the
API from the same nginx, and the Vite dev server proxies `/api`
(frontend/vite.config.ts), so neither deployment nor development needs CORS
at all. The default is therefore empty — no cross-origin access — and the
middleware is only installed when origins are configured deliberately.
An explicit `*` is still honoured for a genuinely public read-only setup, but
never together with credentials, which is what the spec intends `*` to mean
anyway.
39 lines
1.6 KiB
Plaintext
39 lines
1.6 KiB
Plaintext
# Copy this file to .env and adjust values before running `docker compose up`.
|
|
|
|
# --- Postgres ---
|
|
AURUM_POSTGRES_USER=aurum
|
|
AURUM_POSTGRES_PASSWORD=change-me
|
|
AURUM_POSTGRES_DB=aurum
|
|
AURUM_POSTGRES_HOST=db
|
|
AURUM_POSTGRES_PORT=5432
|
|
|
|
# --- Backend ---
|
|
# Comma-separated list of browser origins allowed to call the API. Leave it
|
|
# empty unless you serve the frontend from a different origin than the API:
|
|
# docker compose serves both from the same nginx, and the Vite dev server
|
|
# proxies /api, so neither needs this. "*" is honoured but then credentials
|
|
# are never granted, because "*" plus credentials lets any site you visit
|
|
# read this instance.
|
|
AURUM_CORS_ORIGINS=
|
|
AURUM_DEFAULT_CURRENCY=USD
|
|
|
|
# --- Crypto tab (live prices via CoinGecko) ---
|
|
# Free Demo API key, no card required: coingecko.com/en/api/pricing. Leave
|
|
# blank and the Crypto tab's price sync just 400s with a message telling
|
|
# you to set this — nothing else in the app is affected.
|
|
AURUM_COINGECKO_API_KEY=
|
|
|
|
# --- Basic auth (STRONGLY recommended if this instance is reachable from
|
|
# anywhere other than your own machine) ---
|
|
# Aurum has no login system of its own — it's built for one person
|
|
# self-hosting their own private instance, not a multi-tenant service.
|
|
# Leave both blank and there is NO password on this app at all: anyone who
|
|
# can reach it can read, edit, and delete every transaction, account, and
|
|
# asset. Set both to put an HTTP Basic Auth prompt in front of the whole
|
|
# app (UI + API). See frontend/docker-entrypoint.d/20-basic-auth.sh.
|
|
AURUM_BASIC_AUTH_USER=
|
|
AURUM_BASIC_AUTH_PASSWORD=
|
|
|
|
# --- Ports exposed on your host machine ---
|
|
AURUM_WEB_PORT=3000
|