From 55ae6cdd3eafac4e04c2def38cda05bd634af382 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Verstraeten?= <cedric@verstraeten.io>
Date: Thu, 20 Aug 2026 21:33:32 +0200
Subject: [PATCH] Add dynamic CORS origins and secure refresh cookie

Update the hub API Helm template to set `REFRESH_COOKIE_SECURE` automatically when the API schema is HTTPS, and generate `CORS_ALLOWED_ORIGINS` from configured frontend URLs (legacy URL, domain list, tenant wildcard domain, and demo URL). This keeps cookie behavior and CORS config aligned with deployment settings.
---
 charts/hub/templates/kerberos-hub/hub-api.yaml | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/charts/hub/templates/kerberos-hub/hub-api.yaml b/charts/hub/templates/kerberos-hub/hub-api.yaml
index dc3d81c..e799378 100644
--- a/charts/hub/templates/kerberos-hub/hub-api.yaml
+++ b/charts/hub/templates/kerberos-hub/hub-api.yaml
@@ -194,6 +194,23 @@ spec:
               value: "{{ .Values.kerberoshub.api.schema }}://{{ .Values.kerberoshub.api.url }}"
             - name: PUBLIC_URL
               value: "{{ .Values.kerberoshub.frontend.schema }}://{{ .Values.kerberoshub.frontend.url }}"
+            - name: REFRESH_COOKIE_SECURE
+              value: {{ eq .Values.kerberoshub.api.schema "https" | quote }}
+            {{- $corsOrigins := list }}
+            {{- with .Values.kerberoshub.frontend.legacyUrl }}
+            {{- $corsOrigins = append $corsOrigins (printf "%s://%s" $.Values.kerberoshub.frontend.schema .) }}
+            {{- end }}
+            {{- range .Values.kerberoshub.frontend.domains }}
+            {{- $corsOrigins = append $corsOrigins (printf "%s://%s" $.Values.kerberoshub.frontend.schema .) }}
+            {{- end }}
+            {{- if and .Values.kerberoshub.frontend.multiTenant .Values.kerberoshub.frontend.tenantBaseDomain }}
+            {{- $corsOrigins = append $corsOrigins (printf "%s://*.%s" .Values.kerberoshub.frontend.schema .Values.kerberoshub.frontend.tenantBaseDomain) }}
+            {{- end }}
+            {{- if and .Values.kerberoshub.frontend.demoEnabled .Values.kerberoshub.frontend.demoUrl }}
+            {{- $corsOrigins = append $corsOrigins (printf "%s://%s" .Values.kerberoshub.frontend.schema .Values.kerberoshub.frontend.demoUrl) }}
+            {{- end }}
+            - name: CORS_ALLOWED_ORIGINS
+              value: {{ join "," $corsOrigins | quote }}
             {{ if .Values.isPrivate }}
             - name: KERBEROS_PRIVATE_CLOUD
               value: "true"