-
Notifications
You must be signed in to change notification settings - Fork 9
Fix Socket.IO Uploads by Aligning Server/Client Paths #267
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|
@@ -27,7 +27,7 @@ class SocketIOContextRequest(FlaskRequest): | |||||||||||||||||||||||
| def mdv_socketio(app: Flask): | ||||||||||||||||||||||||
| """ | ||||||||||||||||||||||||
| Experimental and not to be trusted pending design work etc. | ||||||||||||||||||||||||
|
|
||||||||||||||||||||||||
| Do we have a SocketIO for the entire app and route messages internally, | ||||||||||||||||||||||||
| - yes probably. | ||||||||||||||||||||||||
| What `path` should it use? We'll need to make sure it is compatible with | ||||||||||||||||||||||||
|
|
@@ -40,8 +40,15 @@ def mdv_socketio(app: Flask): | |||||||||||||||||||||||
| global socketio | ||||||||||||||||||||||||
| # allow cors for localhost:5170-5179 | ||||||||||||||||||||||||
| # cors = [f"http://localhost:{i}" for i in range(5170,5180)] | ||||||||||||||||||||||||
| socketio = SocketIO(app, cors_allowed_origins="*") | ||||||||||||||||||||||||
| log("socketio initialized with cors_allowed_origins wildcard") | ||||||||||||||||||||||||
|
|
||||||||||||||||||||||||
| # Get the API root path for SocketIO path configuration | ||||||||||||||||||||||||
| api_root = app.config.get('mdv_api_root', '/') | ||||||||||||||||||||||||
| if api_root != '/' and not api_root.endswith('/'): | ||||||||||||||||||||||||
| api_root += '/' | ||||||||||||||||||||||||
| socketio_path = f"{api_root}socket.io" | ||||||||||||||||||||||||
|
|
||||||||||||||||||||||||
| socketio = SocketIO(app, cors_allowed_origins="*", path=socketio_path) | ||||||||||||||||||||||||
| log(f"socketio initialized with cors_allowed_origins wildcard and path={socketio_path}") | ||||||||||||||||||||||||
|
Comment on lines
+50
to
+51
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Avoid wildcard CORS in production; make origins configurable. Using cors_allowed_origins="" is a security posture gap. Read allowed origins from config and fall back to "" only in dev/test. Apply this diff: - socketio = SocketIO(app, cors_allowed_origins="*", path=socketio_path)
- log(f"socketio initialized with cors_allowed_origins wildcard and path={socketio_path}")
+ origins_cfg = app.config.get("MDV_CORS_ALLOWED_ORIGINS") or app.config.get("mdv_cors_allowed_origins")
+ if isinstance(origins_cfg, str):
+ allowed_origins = [o.strip() for o in origins_cfg.split(",") if o.strip()]
+ else:
+ allowed_origins = origins_cfg
+ if not allowed_origins:
+ allowed_origins = "*" if (app.debug or app.testing) else []
+ socketio = SocketIO(app, cors_allowed_origins=allowed_origins, path=socketio_path)
+ log(f"socketio initialized path={socketio_path} cors={allowed_origins}")📝 Committable suggestion
Suggested change
|
||||||||||||||||||||||||
|
|
||||||||||||||||||||||||
| # @socketio.on("message") | ||||||||||||||||||||||||
| # def message(data): | ||||||||||||||||||||||||
|
|
||||||||||||||||||||||||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Reapply PrefixMiddleware after setting default MDV_API_ROOT
When the module loads, we capture
MDV_API_ROOTand (optionally) wrapapp.wsgi_app. Later, inside the__main__block, we set the default/test/value if the variable was absent. Because the middleware was already skipped earlier, we never re-wrap the app after this assignment. As a result, runningpython safe_mdv_app.pywith no pre-set env var leaves the server listening on the root path while the rest of the stack believes it’s under/test/, recreating the socket path mismatch we’re trying to solve.Please move the prefix application into a helper that can be invoked both at module load and after setting the default, e.g.:
This keeps the import-time behavior for deployments while ensuring the local default actually takes effect.
Also applies to: 58-66
🤖 Prompt for AI Agents