Configures CORS policy for development and production
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
실행 점수 미검증
설치 방법 보기설치하기 전에 에이전트에게 전달되는 지시 내용을 확인할 수 있습니다.
Type: L3 Worker Category: 7XX Project Bootstrap Parent: ln-770-crosscutting-setup
Configures Cross-Origin Resource Sharing (CORS) policy with security-first approach.
| Aspect | Details |
|---|---|
| Input | Context Store from ln-770 |
| Output | CORS configuration with environment-specific policies |
| Stacks | .NET (ASP.NET Core CORS), Python (FastAPI CORSMiddleware) |
Accept Context Store from coordinator.
Required Context:
STACK: .NET or PythonPROJECT_ROOT: Project directory pathENVIRONMENT: Development or ProductionIdempotency Check:
AddCors or UseCorsCORSMiddleware{ "status": "skipped" }Determine frontend configuration.
Detection Steps:
/frontend, /client, /web).env or appsettings.json for CORS_ORIGINSDetected Frontend Origins:
| Framework | Default Port | Origin |
|---|---|---|
| React (CRA) | 3000 | http://localhost:3000 |
| Vite | 5173 | http://localhost:5173 |
| Angular | 4200 | http://localhost:4200 |
| Next.js | 3000 | http://localhost:3000 |
| Environment | Strategy |
|---|---|
| Development | Allow localhost origins (configurable) |
| Production | Explicit origins from environment variables only |
Security Warning: Never use * (wildcard) with credentials.
| Method | Default | Notes |
|---|---|---|
| GET | ✓ Yes | Read operations |
| POST | ✓ Yes | Create operations |
| PUT | ✓ Yes | Update operations |
| DELETE | ✓ Yes | Delete operations |
| PATCH | Optional | Partial updates |
| OPTIONS | ✓ Yes | Preflight requests (automatic) |
| Scenario | AllowCredentials | Notes |
|---|---|---|
| Cookie-based auth | ✓ Yes | Required for cookies |
| JWT in header | ✗ No | Not needed |
| OAuth2 | Depends | Check documentation |
Warning: AllowCredentials = true prohibits * origin.
| Environment | MaxAge | Rationale |
|---|---|---|
| Development | 0 | Immediate config changes |
| Production | 86400 (24h) | Reduce preflight requests |
| File | Purpose |
|---|---|
Extensions/CorsExtensions.cs | CORS service registration |
appsettings.json (update) | Origins configuration |
appsettings.Development.json (update) | Dev origins |
Generation Process:
Registration Code:
builder.Services.AddCorsPolicy(builder.Configuration);
// ...
app.UseCors(builder.Environment.IsDevelopment() ? "Development" : "Production");
| File | Purpose |
|---|---|
middleware/cors_config.py | CORS middleware configuration |
.env (update) | CORS_ORIGINS variable |
Generation Process:
Registration Code:
from middleware.cors_config import configure_cors
configure_cors(app)
Validation Steps:
Syntax check:
dotnet build --no-restorepython -m py_compile middleware/cors_config.pyCORS test:
# Test preflight request
curl -X OPTIONS http://localhost:5000/api/test \
-H "Origin: http://localhost:3000" \
-H "Access-Control-Request-Method: POST" \
-v
Verify headers:
Access-Control-Allow-Origin: Should match request originAccess-Control-Allow-Methods: Should list allowed methodsAccess-Control-Allow-Credentials: true (if enabled)Access-Control-Max-Age: Cache durationBefore completing, verify:
* origin in productionAllowAnyMethod in prod){
"status": "success",
"files_created": [
"Extensions/CorsExtensions.cs"
],
"packages_added": [],
"registration_code": "builder.Services.AddCorsPolicy(configuration);",
"message": "Configured CORS with Development and Production policies"
}
* origin with credentials — security violation per CORS specAddCors/UseCors or CORSMiddleware exists, return status: "skipped"dotnet build or py_compile)Version: 2.0.0 Last Updated: 2026-01-10
아직 리뷰가 없습니다. 사용해 본 소감을 남겨 주세요.
로그인 없이 쓸 수 있습니다. 사용 후기, 질문, 작동하지 않은 환경 등을 편하게 남겨 주세요.
아직 댓글이 없습니다. 첫 댓글을 남겨 보세요.
Design, implement, and audit inclusive digital products using WCAG 2.2 Level AA standards. Use this skill to generate semantic ARIA for Web and accessibility traits for Web and Native platforms (iOS/Android).
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Whole site or product — a full web accessibility (a11y) audit against WCAG 2.2, following the WCAG-EM methodology. Defines scope, samples representative pages and flows, runs the automated tier (`accessibility-scan`) and the hands-on manual tier (`accessibility-inspect`), and produces one conformance report. Grades each finding by severity and evidence basis, and states per-criterion conformance as pass, fail, or undetermined (needs a human). Use it for 'audit my site for accessibility', 'is this product accessible', 'a11y audit', 'WCAG or Section 508 conformance report', or any multi-page assessment. Assesses; does not fix (use `accessibility-fix`) or diff (use `accessibility-diff`). For a single page use `accessibility-scan`; for hands-on keyboard and screen-reader checks use `accessibility-inspect`.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Regression check — diff a live page's web accessibility (a11y) violations against a baseline. By default it compares your uncommitted changes (stash-based); pass `--branch [<name>]` to compare against a branch. Reports the new WCAG violations introduced, the ones fixed, and the count of pre-existing ones. Use it for 'did my change break accessibility', 'what a11y issues did this PR add', or as a CI gate. For a full scan of one page use `accessibility-scan`; for a whole site use `accessibility-audit`.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Remediation only — repair web accessibility (a11y) violations against WCAG 2.2 with a baseline, edit, and verify loop. Takes a target (URL, files, directory) or a findings worklist from `accessibility-scan`/`accessibility-inspect`/`accessibility-audit`, applies mechanical fixes as given, leaves TODOs for visual or contextual judgment, and verifies by re-running the baseline check. It only fixes. To find issues use `accessibility-scan` (one page, automated), `accessibility-inspect` (one page, manual), or `accessibility-audit` (whole site, WCAG-EM); to check for regressions use `accessibility-diff`. Use it for 'fix the a11y issues in X', 'make this accessible', 'add missing alt text and labels', 'apply these accessibility fixes', 'remediate these violations'.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
One page, hands-on manual tier — drive a live page through the web accessibility (a11y) checks a rule engine can't decide: keyboard operation and focus order, screen-reader names, roles and states from the accessibility tree, reflow and zoom, reduced motion, form errors, and target size. Grades each finding by evidence basis (verified / confirm-with-a-human / human-required) and severity, and closes every criterion in a ledger: verified, flagged, not exercised, or N/A. Locates and assesses; does not fix (use `accessibility-fix`). Use it for keyboard testing, focus-order checks, screen-reader or a11y-tree review, reflow and zoom at 200%, or 'is this operable, not just lint-clean'. The automated tier is `accessibility-scan`; `accessibility-audit` runs both across a sampled site.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
One page, automated tier — run the web accessibility (a11y) rule engine against a live page and locate every violation it can detect mechanically. Pass a URL, a config target name (e.g. `accesslint:accessibility-scan dev`), or nothing to use the default target from `accesslint.config.json`. Ensures a debuggable Chrome, runs the @accesslint/core engine over CDP, and returns a worklist of live-DOM WCAG 2.2 violations, each grounded to its DOM selector and source `file:line`. Locates; doesn't edit. Use it for 'is this page accessible', 'check a11y on this URL', 'find contrast and alt-text issues', or to verify a UI change. For hands-on keyboard and screen-reader checks use `accessibility-inspect`; for a whole site or product use `accessibility-audit`; to diff against uncommitted changes or a branch use `accessibility-diff`.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.