[Fix] WebSocket CORS 전체 origin 허용 제한#208
Conversation
|
Important Review skippedAuto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Repository UI Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! 본 PR은 WebSocket 통신 시 발생할 수 있는 보안 취약점을 방지하기 위해 CORS 설정을 최적화하는 내용을 담고 있습니다. 기존의 광범위한 와일드카드 허용 방식을 특정 도메인 및 로컬 호스트 패턴으로 구체화하여, 승인되지 않은 출처로부터의 접근을 차단하고 시스템 보안성을 높이는 것을 목적으로 합니다. Highlights
New Features🧠 You can now enable Memory (public preview) to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console. Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request restricts the CORS allowed origin patterns for WebSocket connections in both SecurityConfig and WebSocketConfig from wildcard (*) to specific patterns (http://localhost:* and https://lgenius.site). The review feedback suggests externalizing these hardcoded CORS configurations to environment-specific properties files (e.g., application.yaml) to avoid duplication and prevent security risks in production environments.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
| // TODO: production 에서는 모바일 앱 origin 만 명시적으로 허용하도록 좁힐 것. | ||
| CorsConfiguration wsConfig = new CorsConfiguration(); | ||
| wsConfig.setAllowedOriginPatterns(List.of("*")); | ||
| wsConfig.setAllowedOriginPatterns(List.of("http://localhost:*", "https://lgenius.site")); |
There was a problem hiding this comment.
[P2] CORS 허용 Origin 설정 외재화 및 중복 제거 권장
문제점
현재 SecurityConfig와 WebSocketConfig 두 곳에 CORS 허용 Origin 패턴("http://localhost:*", "https://lgenius.site")이 하드코딩되어 중복 존재합니다. 또한, 운영(production) 환경에서도 http://localhost:*와 같은 로컬 개발용 주소가 허용되어 보안상 아쉬움이 있습니다.
영향
- 운영 환경에서 불필요하게 로컬 호스트(
localhost)의 접근을 허용하여 보안 취약점이 될 수 있습니다. - 도메인이 변경되거나 허용할 Origin이 추가될 때마다 자바 코드를 수정하고 재빌드해야 하므로 유지보수성이 떨어집니다.
- 두 설정 파일(
SecurityConfig,WebSocketConfig)의 허용 Origin이 불일치할 경우 예기치 않은 CORS 에러가 발생할 수 있습니다.
개선 제안
CORS 설정을 application.yaml 및 application-prod.yaml로 외재화(Externalize)하여 환경별로 다르게 적용하고, @Value 등을 통해 주입받아 사용하도록 개선하는 것을 권장합니다.
예시:
cors:
allowed-origins:
- "http://localhost:3000"
- "http://localhost:8081"
- "https://lgenius.site"
allowed-websocket-origins:
- "http://localhost:*"
- "https://lgenius.site"application-prod.yaml (운영 환경)
cors:
allowed-origins:
- "https://lgenius.site"
allowed-websocket-origins:
- "https://lgenius.site"1 participant
🧾 요약
*)를 특정 패턴으로 제한하여 악성 사이트 GPS 세션 탈취 방지🔗 이슈
✨ 변경 내용
SecurityConfig: REST/WebSocket CORS 설정 분리 — REST는setAllowedOrigins(exact match), WebSocket은setAllowedOriginPatterns(pattern match)WebSocketConfig:setAllowedOriginPatterns("*")→setAllowedOriginPatterns("http://localhost:*", "https://lgenius.site")✅ 확인