added ability to disable cors at the backend

autogpt_platform/backend/backend/server/rest_api.py

@@ -252,13 +252,19 @@ async def health():
 
 class AgentServer(backend.util.service.AppProcess):
     def run(self):
-        server_app = starlette.middleware.cors.CORSMiddleware(
-            app=app,
-            allow_origins=settings.config.backend_cors_allow_origins,
-            allow_credentials=True,
-            allow_methods=["*"],  # Allows all methods
-            allow_headers=["*"],  # Allows all headers
-        )
+
+        if settings.config.enable_cors_all_origins:
+            server_app = starlette.middleware.cors.CORSMiddleware(
+                app=app,
+                allow_origins=settings.config.backend_cors_allow_origins,
+                allow_credentials=True,
+                allow_methods=["*"],  # Allows all methods
+                allow_headers=["*"],  # Allows all headers
+            )
+        else:
+            logger.info("CORS is disabled")
+            server_app = app
+
         uvicorn.run(
             server_app,
             host=backend.util.settings.Config().agent_api_host,

autogpt_platform/backend/backend/server/ws_api.py

@@ -295,14 +295,17 @@ async def health():
 
 class WebsocketServer(AppProcess):
     def run(self):
-        logger.info(f"CORS allow origins: {settings.config.backend_cors_allow_origins}")
-        server_app = CORSMiddleware(
-            app=app,
-            allow_origins=settings.config.backend_cors_allow_origins,
-            allow_credentials=True,
-            allow_methods=["*"],
-            allow_headers=["*"],
-        )
+        if settings.config.enable_cors_all_origins:
+            server_app = CORSMiddleware(
+                app=app,
+                allow_origins=settings.config.backend_cors_allow_origins,
+                allow_credentials=True,
+                allow_methods=["*"],
+                allow_headers=["*"],
+            )
+        else:
+            logger.info("CORS is disabled")
+            server_app = app
 
         uvicorn.run(
             server_app,

autogpt_platform/backend/backend/util/settings.py

@@ -368,6 +368,11 @@ class Config(UpdateTrackingModel["Config"], BaseSettings):
         description="Maximum message size limit for communication with the message bus",
     )
 
+    enable_cors_all_origins: bool = Field(
+        default=True,
+        description="Whether to enable all CORS origins",
+    )
+
     backend_cors_allow_origins: List[str] = Field(default=["http://localhost:3000"])
 
     @field_validator("backend_cors_allow_origins")