# How to Configure CORS Settings in Pixelle-Video for Secure API Access

> Secure your Pixelle-Video API access by learning how to configure CORS settings. Understand the default configuration and how to manage origins effectively.

- Repository: [AIDC-AI/Pixelle-Video](https://github.com/AIDC-AI/Pixelle-Video)
- Tags: how-to-guide
- Published: 2026-04-23

---

**CORS in Pixelle-Video is enabled by default for all origins and controlled through the `APIConfig` model in [`api/config.py`](https://github.com/AIDC-AI/Pixelle-Video/blob/main/api/config.py), with the middleware applied in [`api/app.py`](https://github.com/AIDC-AI/Pixelle-Video/blob/main/api/app.py).**

The Pixelle-Video API is built with **FastAPI**, and Cross-Origin Resource Sharing (CORS) is configured centrally to allow web clients to interact with the API from specified origins. Whether you need to tighten security with a strict whitelist or disable CORS entirely for internal-only access, the configuration is straightforward and requires modifying only two fields in the source code.

## Where CORS Configuration Lives in Pixelle-Video

The CORS behavior is split across two key files in the `api/` directory:

| Component | Purpose | Location |
|-----------|---------|----------|
| `APIConfig` | Pydantic model that stores `cors_enabled` (boolean) and `cors_origins` (list of strings) | [`api/config.py`](https://github.com/AIDC-AI/Pixelle-Video/blob/main/api/config.py) (lines 21–49) |
| `api_config` | Singleton instance created at import time | [`api/config.py`](https://github.com/AIDC-AI/Pixelle-Video/blob/main/api/config.py) (line 49) |
| CORS middleware registration | Conditional addition of `CORSMiddleware` based on config values | [`api/app.py`](https://github.com/AIDC-AI/Pixelle-Video/blob/main/api/app.py) (lines 112–120) |

This architecture ensures that CORS settings are type-validated by Pydantic and applied consistently when the FastAPI application starts.

## How CORS Middleware Is Applied

In [`api/app.py`](https://github.com/AIDC-AI/Pixelle-Video/blob/main/api/app.py), the startup logic checks the configuration and registers the middleware accordingly:

```python
if api_config.cors_enabled:
    app.add_middleware(
        CORSMiddleware,
        allow_origins=api_config.cors_origins,
        allow_credentials=True,
        allow_methods=["*"],
        allow_headers=["*"],
    )
    logger.info(f"CORS enabled for origins: {api_config.cors_origins}")

```

The configuration exposes two tunable parameters:

- **`cors_enabled`** — Boolean toggle that determines whether the middleware is registered at all
- **`cors_origins`** — List of allowed origin strings; use `["*"]` to permit any origin, or specify exact domains for restricted access

Both values default to permissive settings (`True` and `["*"]`), which is suitable for development but should be hardened for production deployments.

## Step-by-Step: Configuring CORS Settings

### To Disable CORS Completely

For scenarios where the API is only accessed by trusted internal services (no browser clients), set `cors_enabled` to `False`:

```python

# api/config.py

class APIConfig(BaseModel):
    # ... other fields ...

    
    # CORS settings

    cors_enabled: bool = False   # Disable CORS middleware

    cors_origins: list[str] = [] # Ignored when disabled

```

Restart the server to apply the change.

### To Restrict to Specific Origins

For production environments, replace the wildcard with an explicit whitelist:

```python

# api/config.py

class APIConfig(BaseModel):
    # ... other fields ...

    
    # CORS settings

    cors_enabled: bool = True
    cors_origins: list[str] = [
        "https://myapp.example.com",
        "https://admin.example.com",
        "https://localhost:3000",  # For local development testing

    ]

```

### To Verify Your Configuration

After starting the server, check the log output for confirmation:

```bash

# Expected log line

CORS enabled for origins: ['https://myapp.example.com', 'https://admin.example.com']

```

This log is emitted by the `logger.info` call at line 120 of [`api/app.py`](https://github.com/AIDC-AI/Pixelle-Video/blob/main/api/app.py). If CORS is disabled, this line will not appear in the logs.

## Important Notes on Configuration Scope

The Pixelle-Video repository does not expose CORS settings through environment variables or external configuration files by default. To make CORS configurable without modifying source code, you would need to extend `APIConfig` to read from `os.environ` or a [`config.yaml`](https://github.com/AIDC-AI/Pixelle-Video/blob/main/config.yaml) file—this requires code changes beyond the stock implementation.

For deployments using container orchestration, consider building a custom image with your modified [`api/config.py`](https://github.com/AIDC-AI/Pixelle-Video/blob/main/api/config.py) baked in, or mount a configuration file at runtime if you implement external configuration support.

## Summary

- **CORS in Pixelle-Video** is controlled by the `APIConfig` model in [`api/config.py`](https://github.com/AIDC-AI/Pixelle-Video/blob/main/api/config.py) and applied via `CORSMiddleware` in [`api/app.py`](https://github.com/AIDC-AI/Pixelle-Video/blob/main/api/app.py)
- **Default behavior** enables CORS for all origins (`["*"]`), suitable for development
- **To customize**: modify `cors_enabled` (boolean toggle) and `cors_origins` (list of allowed domains) in [`api/config.py`](https://github.com/AIDC-AI/Pixelle-Video/blob/main/api/config.py)
- **To disable**: set `cors_enabled = False`
- **To verify**: check server logs for the line `CORS enabled for origins: [...]`

## Frequently Asked Questions

### How do I completely disable CORS in Pixelle-Video?

Set `cors_enabled = False` in the `APIConfig` class defined in [`api/config.py`](https://github.com/AIDC-AI/Pixelle-Video/blob/main/api/config.py). This prevents the `CORSMiddleware` from being registered when the application starts. The `cors_origins` list is ignored when CORS is disabled.

### Can I configure CORS through environment variables instead of editing source code?

Not by default. The stock `APIConfig` class in [`api/config.py`](https://github.com/AIDC-AI/Pixelle-Video/blob/main/api/config.py) does not read from environment variables. To enable this, you would need to modify the class to use Pydantic's `BaseSettings` or manually parse `os.environ` values for `cors_enabled` and `cors_origins`.

### What log output confirms that CORS is active?

When the server starts with CORS enabled, you will see: `CORS enabled for origins: ['origin1', 'origin2']`. This message is generated by the `logger.info` call at line 120 of [`api/app.py`](https://github.com/AIDC-AI/Pixelle-Video/blob/main/api/app.py). If this line is absent from your logs, CORS is either disabled or the middleware registration failed.

### Is the default CORS configuration secure for production?

No. The default settings (`cors_enabled = True`, `cors_origins = ["*"]`) allow any website to make requests to your API. For production deployments, restrict `cors_origins` to your verified frontend domains and consider whether you need CORS at all if your API is only accessed server-to-server.