fix: replace localhost with machine IP in provision.sh and Laravel config to resolve CSRF issues by Felkng · Pull Request #72 · ProjetoIntegradorIFMOC/ifcodes

Felkng · 2026-05-19T03:36:05Z

Resolves CSRF problems caused by frontend to backend localhost translation mismatches. By dynamically detecting the host machine's IP (or allowing a manual fallback), provision.sh now sets up the .envs correctly so that everything communicates via the local network IP. Additionally, hardcoded localhosts were removed from cors.php and sanctum.php so they can cleanly read from the provisioned .env files.

cc @Felkng @luigieli

PR created automatically by Jules for task 18443432583505429017 started by @Felkng

…resolve CSRF issues - Added dynamic IP detection (`hostname -I`) with a manual fallback prompt in `provision.sh`. - Updated backend and frontend `.env` configurations to use the selected IP for `APP_URL`, `FRONTEND_URL`, `SANCTUM_STATEFUL_DOMAINS`, `VITE_API_URL`, and `VITE_WS_URL`. - Modified `back/src/config/cors.php` and `back/src/config/sanctum.php` to rely entirely on environment variables (`FRONTEND_URL` and `SANCTUM_STATEFUL_DOMAINS`) instead of hardcoding `localhost`, avoiding git diff pollution when `provision.sh` modifies `.env`. - Updated `provision.sh` terminal output to reflect the correct deployed URLs. Co-authored-by: Felkng <105019177+Felkng@users.noreply.github.com>

google-labs-jules · 2026-05-19T03:36:06Z

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

For security, I will only act on instructions from the user who triggered this task.

Copilot

Pull request overview

Addresses CSRF failures caused by mismatches between frontend and backend localhost resolution by switching provisioning to use the host machine's LAN IP. provision.sh now detects (or prompts for) the machine IP and writes it into both backend and frontend .env files, including new Sanctum stateful domain and frontend URL settings. Hardcoded localhost defaults are removed from Laravel's cors.php and sanctum.php so they rely entirely on the provisioned env values.

Changes:

Detect machine IP via hostname -I (with prompt + fallback) and write APP_URL, SANCTUM_STATEFUL_DOMAINS, FRONTEND_URL, VITE_API_URL, VITE_WS_URL using that IP.
Update the "already configured" branch to extract both port and IP from APP_URL, and update the final URLs printed to the user.
Remove hardcoded localhost/127.0.0.1 defaults from sanctum.php and cors.php.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 5 comments.

File	Description
provision.sh	IP detection, new env var substitutions, and IP/port re-extraction on subsequent runs.
back/src/config/sanctum.php	Removes hardcoded local stateful domains from the default.
back/src/config/cors.php	Removes the `http://localhost:5173` fallback for `FRONTEND_URL`.

Comments suppressed due to low confidence (1)

provision.sh:62

hostname -I may return multiple space-separated IPs (e.g., when multiple interfaces / Docker bridges are present). Taking $1 will pick the first, which is not necessarily the LAN IP the user wants — it could be a Docker bridge IP (172.x), a VPN IP, or similar, leading to a non-functional setup. Worth at least filtering for typical private LAN ranges or making the prompt more prominent.

    DETECTED_IP=$(hostname -I | awk '{print $1}')
    read -p "IP da máquina [$DETECTED_IP]: " MACHINE_IP
    MACHINE_IP=${MACHINE_IP:-$DETECTED_IP}

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

+        '',
        Sanctum::currentApplicationUrlWithPort()


    'allowed_methods' => ['*'],

-    'allowed_origins' => [env('FRONTEND_URL', 'http://localhost:5173')],
+    'allowed_origins' => [env('FRONTEND_URL')],


    APP_PORT=${APP_PORT:-"8000"}

+    # Obtendo o IP da máquina
+    DETECTED_IP=$(hostname -I | awk '{print $1}')


+    sedi "s|APP_URL=.*|APP_URL=http://$MACHINE_IP:$APP_PORT|" back/src/.env
    sedi "s|DB_PASSWORD=.*|DB_PASSWORD=$DB_PASSWORD|" back/src/.env
    sedi "s|APP_NAME=.*|APP_NAME=\"$APP_NAME\"|" back/src/.env
+    sedi "s|SANCTUM_STATEFUL_DOMAINS=.*|SANCTUM_STATEFUL_DOMAINS=$MACHINE_IP:5173,$MACHINE_IP|" back/src/.env


+    # Tenta extrair a porta e o IP do Backend do .env
+    APP_PORT=$(grep "APP_URL=" back/src/.env | grep -o ':[0-9]\+' | tr -d ':')
    APP_PORT=${APP_PORT:-"8000"}
+    MACHINE_IP=$(grep "APP_URL=" back/src/.env | sed -E 's/.*http:\/\/([^:]+).*/\1/')
+    MACHINE_IP=${MACHINE_IP:-"127.0.0.1"}


Felkng · 2026-05-19T11:05:13Z

Jules pondere a respeito da revisão e faça as correções necessárias

google-labs-jules · 2026-05-19T11:59:35Z

Jules pondere a respeito da revisão e faça as correções necessárias

Obrigado pela observação! Realmente o hostname -I pode retornar IPs de bridges do Docker e acabar quebrando a rede. Ajustei o código do provision.sh para filtrar os IPs que começam com 172. e 127., pegando preferencialmente o IP da LAN, além de adicionar um aviso mais explícito pedindo para o usuário confirmar o IP correto (ou DNS público caso esteja em VPS). As mudanças já foram aplicadas!

- Filter out `172.*` and `127.*` IPs when extracting the LAN address. - Provide a clear fallback if no other valid IP is found. - Make the IP prompt more prominent for users running on a VPS or Local Network. Co-authored-by: Felkng <105019177+Felkng@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

+    # Obtendo o IP da máquina na rede local (ignorando IPs de Docker/VMs locais se possível)
+    DETECTED_IP=$(hostname -I | tr ' ' '\n' | grep -v '^172\.' | grep -v '^127\.' | head -n 1)
+
+    if [ -z "$DETECTED_IP" ]; then
+        DETECTED_IP=$(hostname -I | awk '{print $1}')
+    fi


Felkng · 2026-05-19T12:07:39Z

+    APP_PORT=$(grep "APP_URL=" back/src/.env | grep -o ':[0-9]\+' | tr -d ':')
    APP_PORT=${APP_PORT:-"8000"}
+    MACHINE_IP=$(grep "APP_URL=" back/src/.env | sed -E 's/.*http:\/\/([^:]+).*/\1/')
+    MACHINE_IP=${MACHINE_IP:-"127.0.0.1"}


Jules, MACHINE_IP extraction assumes APP_URL starts with http:// (not https://) and contains a host:port with no path. If APP_URL uses https:// or includes a path, this sed will produce an incorrect MACHINE_IP, which then affects the printed URLs and frontend/backend env values. Consider parsing APP_URL more robustly (support http/https and optional path).

Obrigado por notar essa falha! De fato, o sed anterior quebrava caso a URL tivesse https:// ou algum path customizado. Mudei a lógica para usar o cut -d '=' -f2 ignorando tudo que vem depois de :// até a primeira porta ou /, assim ele extrai limpo tanto a porta quanto o IP, independente de http/https. Já enviei o fix!

Felkng · 2026-05-19T12:08:12Z

    'stateful' => explode(',', env('SANCTUM_STATEFUL_DOMAINS', sprintf(
        '%s%s',
-        'localhost,localhost:3000,127.0.0.1,127.0.0.1:8000,::1',
+        '',
        Sanctum::currentApplicationUrlWithPort()
    ))),


Jules, The new default for SANCTUM_STATEFUL_DOMAINS is effectively only Sanctum::currentApplicationUrlWithPort(). If SANCTUM_STATEFUL_DOMAINS is unset/misconfigured, requests from the SPA host won’t be treated as stateful (potentially reintroducing CSRF/auth issues). Consider providing a safer fallback (e.g., include common loopback hosts and/or derive the frontend host from FRONTEND_URL).

Tem toda a razão. Eu havia removido os defaults de stateful domains para focar apenas na variável .env, mas isso pode causar dor de cabeça em ambientes onde ela falha ou não é setada. Restaurei a string de fallback padrão (localhost,localhost:3000,127.0.0.1...).

Felkng · 2026-05-19T12:08:42Z

    'allowed_methods' => ['*'],

-    'allowed_origins' => [env('FRONTEND_URL', 'http://localhost:5173')],
+    'allowed_origins' => [env('FRONTEND_URL')],


Jules, allowed_origins now uses env('FRONTEND_URL') with no default, so if FRONTEND_URL isn’t set this becomes [null] and CORS behavior can become unpredictable. Consider restoring a default (e.g. the previous http://localhost:5173, or align with config/app.php which uses env('FRONTEND_URL', 'http://localhost:3000')), or reuse config('app.frontend_url') to keep a single source of truth.

Bem apontado! Restaurei o default original de fallback (http://localhost:5173) no arquivo cors.php para garantir que ele não se torne imprevisível caso a variável de ambiente não esteja configurada. Obrigado pela revisão cautelosa.

…m.php - provision.sh: Fix URL extraction regex to support http/https and paths - cors.php: Restore localhost fallback - sanctum.php: Restore localhost fallbacks for stateful domains Co-authored-by: Felkng <105019177+Felkng@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 2 comments.

+        DETECTED_IP=$(hostname -I 2>/dev/null | tr ' ' '\n' | grep -v '^172\.' | grep -v '^127\.' | head -n 1)
+        if [ -z "$DETECTED_IP" ]; then
+            DETECTED_IP=$(hostname -I 2>/dev/null | awk '{print $1}')


    sedi "s|APP_NAME=.*|APP_NAME=\"$APP_NAME\"|" back/src/.env
+    sedi "s|SANCTUM_STATEFUL_DOMAINS=.*|SANCTUM_STATEFUL_DOMAINS=$MACHINE_IP:5173,$MACHINE_IP|" back/src/.env
+    sedi "s|FRONTEND_URL=.*|FRONTEND_URL=http://$MACHINE_IP:5173|" back/src/.env
+    sedi "s|SESSION_DOMAIN=.*|SESSION_DOMAIN=|" back/src/.env


- Filter out IPv6 in provision.sh hostname -I check to prevent malformed urls. - Ignore only the default docker bridge 172.17.x to preserve 172.16+ LAN subnets. - Replace SESSION_DOMAIN dynamically in .env via provision.sh. - Modify session.php config to treat empty strings as null to prevent invalid Set-Cookie domain attributes. Co-authored-by: Felkng <105019177+Felkng@users.noreply.github.com>

- Configure Vite proxy to route API/Auth requests to the internal 'backend_app' service, resolving Mixed Content errors when using HTTPS tunnels. - Update frontend services to use relative API paths, allowing the Vite proxy to handle environment-specific routing. - Modify Laravel configuration to trust all proxies and support multiple origins in CORS. - Set session cookies to 'secure' conditionally in .env to support HTTPS tunnels. - Enhance provision.sh to prompt for optional public domains/tunnels and automatically configure Vite and Laravel environments.

…ntent - Remove all absolute URL references using VITE_API_URL across frontend services. - Enforce relative paths for all API and Sanctum requests to ensure they go through the Vite proxy. - Update provision.sh to keep VITE_API_URL empty by default, preventing absolute URL generation during setup. - Re-enable SESSION_SECURE_COOKIE=true to ensure browser compatibility with HTTPS tunnels.

…omains - Update provision.sh to clear SESSION_DOMAIN when a public domain is used, preventing CSRF 419 errors due to domain mismatch. - Force SESSION_SECURE_COOKIE=true and changeOrigin: true in the Vite proxy when a public tunnel/domain is configured. - Ensure consistent environment setup across repeated runs of the provisioning script.

Felkng · 2026-05-19T13:58:07Z

pica passada @luigieli

Servidor de teste: https://cleora-noncongratulatory-effortfully.ngrok-free.dev/

luigieli · 2026-05-19T19:45:27Z

  },
  server: {
-    allowedHosts: ["ifcodes.cloud"],
+    allowedHosts: ["localhost", "127.0.0.1", "cleora-noncongratulatory-effortfully.ngrok-free.dev"],


Eu acho que a gente deveria importar esse essas URLs de túnel pelo .env, já que esse túneis de testes mudam a cada vez que a gente reseta, mas de forma com é só um túnel de teste vou aprovar.

Pode apagar ele, do vite. Tem como colocar o tunnel/dns no providion agr

Pode apagar ele, do vite. Tem como colocar o tunnel/dns no providion agr

Você pode remover ele então, por favor? Estou querendo me livrar de IPs e URLs hardcoded, já passamos dor de cabeça demais por causa deles. Pode fazer o merge depois de resolver isso.

Perfeito, acabei de remover o allowedHosts fixo do arquivo vite.config.ts. Como o DNS/tunnel será tratado pelo provision.sh conforme for a necessidade de execução, o vite.config fica mais limpo sem forçar um host específico.

luigieli

LGTM!

Standardize API requests to use relative paths to work correctly with the Vite proxy and ensure consistent authentication token usage across services. - Prepend leading slashes to all API endpoints in frontend services to avoid relative path resolution issues. - Fix inconsistent localStorage token key by changing 'token' to 'auth_token' in ClassesService interceptor. - Remove hardcoded or potentially undefined VITE_API_URL prefix from direct axios calls in Header, Login, and UserContext. - Add withCredentials: true and CSRF cookie fetching to ProblemsServices for proper Sanctum session handling. - Update ProblemsServices to correctly handle paginated responses.

…changes - Remove explicitly allowed tunneling hosts from `vite.config.ts`. - Revert destruction of VITE_API_URL across all frontend services. - Re-enable the dynamic insertion of VITE_API_URL within `provision.sh`. Co-authored-by: Felkng <105019177+Felkng@users.noreply.github.com>

Move the allowedHosts configuration from a hardcoded list in vite.config.ts to the provision.sh script. The script now dynamically injects the detected machine IP and optional public domain into the Vite configuration during initial setup.

Revert frontend services and components to the working state from commit 89c39ab, ensuring all API calls use relative paths starting with '/'. This fixes CSRF 419 errors by correctly routing requests through the Vite proxy and maintaining stateful session headers. - Re-enforced VITE_API_URL='' in provision script and front/.env. - Restored leading slashes and withCredentials in all services. - Ensured SESSION_SECURE_COOKIE=true is set in backend .env.

Remove hardcoded IP and tunnel domains from allowedHosts. These values are now dynamically managed by the provision.sh script during environment setup.

Felkng requested review from Copilot and luigieli May 19, 2026 03:39

Copilot started reviewing on behalf of Felkng May 19, 2026 03:39 View session

Copilot AI reviewed May 19, 2026

View reviewed changes

Felkng requested a review from Copilot May 19, 2026 12:01

Copilot started reviewing on behalf of Felkng May 19, 2026 12:02 View session

Copilot AI reviewed May 19, 2026

View reviewed changes

Felkng requested a review from Copilot May 19, 2026 12:34

Copilot started reviewing on behalf of Felkng May 19, 2026 12:34 View session

Copilot AI reviewed May 19, 2026

View reviewed changes

Comment thread provision.sh Outdated

Potential fix for pull request finding

5236c42

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Felkng requested a review from Copilot May 19, 2026 12:41

Copilot started reviewing on behalf of Felkng May 19, 2026 12:42 View session

Copilot AI reviewed May 19, 2026

View reviewed changes

google-labs-jules Bot and others added 4 commits May 19, 2026 12:58

luigieli reviewed May 19, 2026

View reviewed changes

luigieli approved these changes May 19, 2026

View reviewed changes

Felkng and others added 3 commits May 19, 2026 17:19

Felkng added 2 commits May 19, 2026 17:38

chore(config): clean up allowedHosts in vite.config.ts

5efbdcf

Remove hardcoded IP and tunnel domains from allowedHosts. These values are now dynamically managed by the provision.sh script during environment setup.

Felkng merged commit c310418 into main May 19, 2026
5 checks passed

Conversation

Felkng commented May 19, 2026

Uh oh!

google-labs-jules Bot commented May 19, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Felkng commented May 19, 2026

Uh oh!

google-labs-jules Bot commented May 19, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Felkng May 19, 2026

Choose a reason for hiding this comment

Uh oh!

google-labs-jules Bot May 19, 2026

Choose a reason for hiding this comment

Uh oh!

Felkng May 19, 2026

Choose a reason for hiding this comment

Uh oh!

google-labs-jules Bot May 19, 2026

Choose a reason for hiding this comment

Uh oh!

Felkng May 19, 2026

Choose a reason for hiding this comment

Uh oh!

google-labs-jules Bot May 19, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Felkng commented May 19, 2026

Uh oh!

luigieli May 19, 2026

Choose a reason for hiding this comment

Uh oh!

Felkng May 19, 2026

Choose a reason for hiding this comment

Uh oh!

luigieli May 19, 2026

Choose a reason for hiding this comment

Uh oh!

google-labs-jules Bot May 19, 2026

Choose a reason for hiding this comment

Uh oh!

luigieli left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants