CFM requests to backend are made via IP address and not requesting hostname

[velomatt]

Problem

Requests from the WebUI to the backend are made to the IP address of the backend, rather than the initiating hostname.

This is typically considered a design flaw for several reasons:

1. Flexibility and Portability: Exposing an IP address ties the front end to a specific backend instance, making it difficult to scale, deploy across different environments, or reroute traffic in case of a change in the backend infrastructure. Using a domain name allows DNS to handle redirection if the backend moves to a different IP or if multiple instances are deployed.

2. Security and Configuration Management: IP-based queries bypass the usual CORS (Cross-Origin Resource Sharing) configurations set up on the domain, which can introduce security vulnerabilities. It also complicates configuration management since IPs might change over time due to network changes, autoscaling, or infrastructure updates.

3. Environment Consistency: In development, staging, and production environments, URLs are usually configured differently. Hardcoding an IP address in the UI introduces inconsistencies across these environments and makes it more challenging to replicate the production environment for testing.

4. Service Discovery: For larger systems or containerized environments (e.g., Docker, Kubernetes), service discovery mechanisms often manage the routing of traffic. IP-based routing bypasses these, which could prevent the system from leveraging built-in load balancing and service monitoring.

Expected behavior

Requests to the backend should automatically use the same hostname or domain as the WebUI request (e.g., if accessing the WebUI at hostname.com:3000, backend requests should go to hostname.com:8080). This will ensure consistency and allow DNS to handle any necessary routing changes.

How to reproduce

1. docker pull ghcr.io/seagate/cfm
2. docker run --restart unless-stopped --network=host --name seagate-cfm --detach ghcr.io/seagate/cfm -webui -verbosity 4
3. navigate to http://cfm-hostname.com:3000
4. monitor network requests through browser developer tools
5. observe backend requests being made to <ip.address.of.host>:8080

Deployment information

Docker version 27.3.1, build ce12230
Ubuntu 24.04.1 LTS

Additional information

No response

[HJ-Fan]

Hi Matthew,

We will look into a better way to handle the deployment. Meanwhile, you could use -hostIpOverride parameter to set the backend to the hostname.

docker run --restart unless-stopped --network=host --name seagate-cfm --detach ghcr.io/seagate/cfm -webui -verbosity 4 -hostIpOverride cfm-hostname.com

[velomatt]

Thanks @HJ-Fan , I can confirm that using hostIpOverride as a workaround does address the CORS issue in my deployment.