Fix: setup CORS for API

Author: vietlvq2609

.github/workflows/master_bellchat.yml

@@ -1,6 +1,5 @@
 # Docs for the Azure Web Apps Deploy action: https://github.com/Azure/webapps-deploy
 # More GitHub Actions for Azure: https://github.com/Azure/actions
-
 name: Build and deploy JAR app to Azure Web App - bellchat
 
 on:
@@ -32,6 +31,7 @@ jobs:
           echo "AZURE_BLOBSTORAGE_CONTAINER_NAME=${{ secrets.AZURE_BLOBSTORAGE_CONTAINER_NAME }}" >> $GITHUB_ENV
           echo "MAINSITE_JWT_SECRET=${{ secrets.MAINSITE_JWT_SECRET }}" >> $GITHUB_ENV
           echo "MAINSITE_JWT_EXPIRATION=${{ secrets.MAINSITE_JWT_EXPIRATION }}" >> $GITHUB_ENV
+          echo "APP_ALLOWED_ORIGINS=${{ secrets.APP_ALLOWED_ORIGINS }}" >> $GITHUB_ENV
 
       - name: Build with Maven
         run: mvn clean install
@@ -50,13 +50,13 @@ jobs:
       url: ${{ steps.deploy-to-webapp.outputs.webapp-url }}
     permissions:
       id-token: write #This is required for requesting the JWT
-  
+
     steps:
       - name: Download artifact from build job
         uses: actions/download-artifact@v3
         with:
           name: java-app
-      
+
       - name: Login to Azure
         uses: azure/login@v1
         with:
@@ -75,6 +75,7 @@ jobs:
           echo "AZURE_BLOBSTORAGE_CONTAINER_NAME=${{ secrets.AZURE_BLOBSTORAGE_CONTAINER_NAME }}" >> $GITHUB_ENV
           echo "MAINSITE_JWT_SECRET=${{ secrets.MAINSITE_JWT_SECRET }}" >> $GITHUB_ENV
           echo "MAINSITE_JWT_EXPIRATION=${{ secrets.MAINSITE_JWT_EXPIRATION }}" >> $GITHUB_ENV
+          echo "APP_ALLOWED_ORIGINS=${{ secrets.APP_ALLOWED_ORIGINS }}" >> $GITHUB_ENV
 
       - name: Deploy to Azure Web App
         id: deploy-to-webapp
@@ -83,4 +84,3 @@ jobs:
           app-name: 'bellchat'
           slot-name: 'Production'
           package: '*.jar'
-          

src/main/java/com/vietle/mychatapi/MychatapiApplication.java

@@ -1,5 +1,6 @@
 package com.vietle.mychatapi;
 
+import org.springframework.beans.factory.annotation.Value;
 import org.springframework.boot.SpringApplication;
 import org.springframework.boot.autoconfigure.SpringBootApplication;
 import org.springframework.context.annotation.Bean;
@@ -8,6 +9,8 @@
 
 @SpringBootApplication
 public class MychatapiApplication {
+	@Value("${app.allowed.origins}")
+    private String[] allowedOrigins;
 
 	public static void main(String[] args) {
 		SpringApplication.run(MychatapiApplication.class, args);
@@ -19,7 +22,7 @@ public WebMvcConfigurer corsConfigurer() {
 			@Override
 			public void addCorsMappings(CorsRegistry registry) {
 				registry.addMapping("/**")
-					.allowedOrigins("*")
+					.allowedOrigins(allowedOrigins)
 					.allowedHeaders("*")
 					.allowedMethods("GET", "POST", "DELETE", "PUT", "PATCH", "OPTIONS");
 			}

src/main/java/com/vietle/mychatapi/config/WebSocketConfig.java

@@ -1,5 +1,6 @@
 package com.vietle.mychatapi.config;
 
+import org.springframework.beans.factory.annotation.Value;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.messaging.simp.config.MessageBrokerRegistry;
 import org.springframework.web.socket.WebSocketHandler;
@@ -14,9 +15,12 @@
 @Configuration
 @EnableWebSocketMessageBroker
 public class WebSocketConfig implements WebSocketMessageBrokerConfigurer {
+    @Value("${app.allowed.origins}")
+    private String[] allowedOrigins;
+
     @Override
     public void registerStompEndpoints(StompEndpointRegistry registry) {
-        registry.addEndpoint("/ws").setAllowedOriginPatterns("*").withSockJS();
+        registry.addEndpoint("/ws").setAllowedOriginPatterns(allowedOrigins).withSockJS();
     }
 
     @Override

src/main/resources/application.properties

@@ -1,6 +1,6 @@
 spring.application.name=mychatapi
 server.port=8080
-
+app.allowed.origins=${APP_ALLOWED_ORIGINS}
 spring.jackson.property-naming-strategy=SNAKE_CASE
 
 ### Database connection