configured dynamic port and cors middleware for production#384
Conversation
✅ Deploy Preview for github-spy ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
📝 WalkthroughWalkthroughBackend server configuration is hardened with a CORS allowlist policy replacing the permissive wildcard, and server startup gains environment-aware port selection with fallback default for cloud deployment compatibility. ChangesServer Security and Deployment Configuration
Estimated Code Review Effort🎯 2 (Simple) | ⏱️ ~12 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
🎉 Thank you @KoderOP for your contribution. Please make sure your PR follows https://github.com/GitMetricsLab/github_tracker/blob/main/CONTRIBUTING.md#-pull-request-guidelines
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
backend/server.js (1)
17-17: ⚡ Quick winHardcoded origins limit deployment flexibility.
For production deployments across different hosting providers (per issue
#48), hardcoding origins requires code changes for each environment. Consider loading allowed origins from an environment variable:-const allowedOrigins = ['http://localhost:5173', 'https://github-spy.etlify.app']; +const allowedOrigins = process.env.ALLOWED_ORIGINS + ? process.env.ALLOWED_ORIGINS.split(',') + : ['http://localhost:5173'];Also, verify
https://github-spy.etlify.appis the correct domain—did you meannetlify.app?🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@backend/server.js` at line 17, Replace the hardcoded allowedOrigins array with a configurable solution: read a new environment variable (e.g., process.env.ALLOWED_ORIGINS) and parse it (comma- or semicolon-separated) into the allowedOrigins array used by your CORS setup (fall back to the existing localhost and the production domain if the env var is absent); update any references to the existing allowedOrigins variable and ensure you validate/trim entries. Also confirm and correct the production domain string (change "https://github-spy.etlify.app" to the intended "https://github-spy.netlify.app" if that was the typo) so the default fallback is accurate.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@backend/server.js`:
- Line 17: Replace the hardcoded allowedOrigins array with a configurable
solution: read a new environment variable (e.g., process.env.ALLOWED_ORIGINS)
and parse it (comma- or semicolon-separated) into the allowedOrigins array used
by your CORS setup (fall back to the existing localhost and the production
domain if the env var is absent); update any references to the existing
allowedOrigins variable and ensure you validate/trim entries. Also confirm and
correct the production domain string (change "https://github-spy.etlify.app" to
the intended "https://github-spy.netlify.app" if that was the typo) so the
default fallback is accurate.
|
already done |
|
Just to clarify the timeline: this issue was completely open when I picked
it up and submitted the PR. It was closed only after my submission was
already in.
If the feature was implemented elsewhere in parallel, I understand, but I
wanted to bring this up to ensure there wasn't a misunderstanding regarding
the contribution order.
…On Sat, May 23, 2026 at 5:44 PM Mehul Prajapati ***@***.***> wrote:
*mehul-m-prajapati* left a comment (GitMetricsLab/github_tracker#384)
<#384 (comment)>
already done
—
Reply to this email directly, view it on GitHub
<#384 (comment)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/BMLNHU6X7TAH6OLAEXXSRJ344GI37AVCNFSM6AAAAACZIKFL6GVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHM2DKMRVGMYDOMJYGY>
.
Triage notifications on the go with GitHub Mobile for iOS
<https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675>
or Android
<https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>.
You are receiving this because you were mentioned.Message ID:
***@***.***>
|
|
🎉🎉 Thank you for your contribution! Your PR #384 has been merged! 🎉🎉 |
|
@KoderOP : ok, merged |
|
Happy to contribute! I really appreciate you valuing the time and efforts taken and merging this |
|
Hi @KoderOP |
|
This issue has been closed. You should look for open issues . All the Best! |
3 participants
Related Issue
Description
Configured the Node.js backend server to support seamless production deployments.
Key changes include Dynamic Port Selection & Enhanced CORS Setup
###How this was verified
Summary by CodeRabbit