Kevin Powell - Community•14mo ago

Having problem with cors - Flask

Hi guys! I am trying to setup restrictions to only allow requests from a certain origin. This is how I have it currently setup but it still allows every request (testing with postman).

app = Flask(__name__)

cors = CORS(app, origins=["https://vetai.vercel.app/"])


@app.route("/")
def home():
    return "Hello, world!"


@app.route("/prompt", methods=["POST"])
def prompt():
    return "prompt route"


if __name__ == "__main__":
    app.run(debug=True)

app = Flask(__name__)

cors = CORS(app, origins=["https://vetai.vercel.app/"])


@app.route("/")
def home():
    return "Hello, world!"


@app.route("/prompt", methods=["POST"])
def prompt():
    return "prompt route"


if __name__ == "__main__":
    app.run(debug=True)

14 Replies

dotfortun•14mo ago

I think this is because it isn't actually cross-origin, since both Postman and the service is running on localhost. I ran your example, and then tried to fetch from another origin and got this:

rikisannOP•14mo ago

Hmm interesanchi Ima host the code on vercel and try it out

dotfortun•14mo ago

Sounds like a plan!

rikisannOP•14mo ago

I tried it but still getting back the response Been thinking to just put an API key in env variables and send it in with requests and just run a normal if API key != api key

dotfortun•14mo ago

That just got me thinking, and I don't know if this is up to date, but evidently Postman doesn't respect CORS.

rikisannOP•14mo ago

is that so so I could potentially access through postman stuff blocked out by cors? or stuff that actually matters has more security than that?

rikisannOP•14mo ago

Calling it through console gives me this error for some reason

dotfortun•14mo ago

Hrm, one sec.

dotfortun•14mo ago

I got this, so I am getting a cors error on my end.

dotfortun•14mo ago

CORS is intended to protect end users from leaking their cookies all over the internet, so it isn't actually a robust security measure for protecting your backend. For that you'd probably want to implement some sort of auth flow (flask-jwt-extended is pretty straightforward to implement), or at least use the API key method you described.

rikisannOP•14mo ago

Sounds good brudda. Thank you so much for the help

dotfortun•14mo ago

Not a problem!

Gaming

Programming

Having problem with cors - Flask