How to Configure CORS Settings in Pixelle-Video for Secure API Access

CORS in Pixelle-Video is enabled by default for all origins and controlled through the APIConfig model in api/config.py, with the middleware applied in api/app.py.

The Pixelle-Video API is built with FastAPI, and Cross-Origin Resource Sharing (CORS) is configured centrally to allow web clients to interact with the API from specified origins. Whether you need to tighten security with a strict whitelist or disable CORS entirely for internal-only access, the configuration is straightforward and requires modifying only two fields in the source code.

Where CORS Configuration Lives in Pixelle-Video

The CORS behavior is split across two key files in the api/ directory:

Component	Purpose	Location
APIConfig	Pydantic model that stores cors_enabled (boolean) and cors_origins (list of strings)	api/config.py (lines 21–49)
api_config	Singleton instance created at import time	api/config.py (line 49)
CORS middleware registration	Conditional addition of CORSMiddleware based on config values	api/app.py (lines 112–120)

This architecture ensures that CORS settings are type-validated by Pydantic and applied consistently when the FastAPI application starts.

How CORS Middleware Is Applied

In api/app.py, the startup logic checks the configuration and registers the middleware accordingly:

if api_config.cors_enabled:
    app.add_middleware(
        CORSMiddleware,
        allow_origins=api_config.cors_origins,
        allow_credentials=True,
        allow_methods=["*"],
        allow_headers=["*"],
    )
    logger.info(f"CORS enabled for origins: {api_config.cors_origins}")

The configuration exposes two tunable parameters:

• cors_enabled — Boolean toggle that determines whether the middleware is registered at all
• cors_origins — List of allowed origin strings; use ["*"] to permit any origin, or specify exact domains for restricted access

Both values default to permissive settings (True and ["*"]), which is suitable for development but should be hardened for production deployments.

Step-by-Step: Configuring CORS Settings

To Disable CORS Completely

For scenarios where the API is only accessed by trusted internal services (no browser clients), set cors_enabled to False:

# api/config.py

class APIConfig(BaseModel):
    # ... other fields ...

    
    # CORS settings

    cors_enabled: bool = False   # Disable CORS middleware

    cors_origins: list[str] = [] # Ignored when disabled

Restart the server to apply the change.

To Restrict to Specific Origins

For production environments, replace the wildcard with an explicit whitelist:

# api/config.py

class APIConfig(BaseModel):
    # ... other fields ...

    
    # CORS settings

    cors_enabled: bool = True
    cors_origins: list[str] = [
        "https://myapp.example.com",
        "https://admin.example.com",
        "https://localhost:3000",  # For local development testing

    ]

To Verify Your Configuration

After starting the server, check the log output for confirmation:

# Expected log line

CORS enabled for origins: ['https://myapp.example.com', 'https://admin.example.com']

This log is emitted by the logger.info call at line 120 of api/app.py. If CORS is disabled, this line will not appear in the logs.

Important Notes on Configuration Scope

The Pixelle-Video repository does not expose CORS settings through environment variables or external configuration files by default. To make CORS configurable without modifying source code, you would need to extend APIConfig to read from os.environ or a config.yaml file—this requires code changes beyond the stock implementation.

For deployments using container orchestration, consider building a custom image with your modified api/config.py baked in, or mount a configuration file at runtime if you implement external configuration support.

Summary

• CORS in Pixelle-Video is controlled by the APIConfig model in api/config.py and applied via CORSMiddleware in api/app.py
• Default behavior enables CORS for all origins (["*"]), suitable for development
• To customize: modify cors_enabled (boolean toggle) and cors_origins (list of allowed domains) in api/config.py
• To disable: set cors_enabled = False
• To verify: check server logs for the line CORS enabled for origins: [...]

Frequently Asked Questions

How do I completely disable CORS in Pixelle-Video?

Set cors_enabled = False in the APIConfig class defined in api/config.py. This prevents the CORSMiddleware from being registered when the application starts. The cors_origins list is ignored when CORS is disabled.

Can I configure CORS through environment variables instead of editing source code?

Not by default. The stock APIConfig class in api/config.py does not read from environment variables. To enable this, you would need to modify the class to use Pydantic's BaseSettings or manually parse os.environ values for cors_enabled and cors_origins.

What log output confirms that CORS is active?

When the server starts with CORS enabled, you will see: CORS enabled for origins: ['origin1', 'origin2']. This message is generated by the logger.info call at line 120 of api/app.py. If this line is absent from your logs, CORS is either disabled or the middleware registration failed.

Is the default CORS configuration secure for production?

No. The default settings (cors_enabled = True, cors_origins = ["*"]) allow any website to make requests to your API. For production deployments, restrict cors_origins to your verified frontend domains and consider whether you need CORS at all if your API is only accessed server-to-server.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}