Issue with ALLOW_ORIGINS Environment Variable Causing Pydantic Error

[prashikdewtale10]

Hi @tarsil,

I am encountering an issue with the ALLOW_ORIGINS environment variable in the Esmerald framework. When setting the ALLOW_ORIGINS environment variable, I am getting a pydantic error indicating that a list is expected, but a string is found. Here is the error message:

allow_origins
Input should be a valid list [type=list_type, input_value='https://mywebsite.com/ https://github.com/', input_type=str]
For further information visit https://errors.pydantic.dev/2.10/v/list_type

I have tried setting the ALLOW_ORIGINS environment variable as a space-separated string, but it seems that pydantic expects a list format. Here is an example of how I set the environment variable:

ALLOW_ORIGINS="https://mywebsite.com https://github.com"

this is how I am specifying in development settings:

class DevelopmentSettings(AppSettings):
    ... 
    allow_origins: list = os.environ["ALLOW_ORIGINS"].split()

    @property
    def cors_config(self) -> CORSConfig:
        """
        Initial Default configuration for the CORS.
        This can be overwritten in another setting or simply override
        `allow_origins` or then override the `def cors_config()`
        property to change the behavior of the whole cors_config.
        """
        if not self.allow_origins:
            return None
        return CORSConfig(
            allow_origins=self.allow_origins,
            allow_methods=self.allow_methods,
            allow_credentials=self.allow_credentials,
        )

This is how I am specifying the cors_config in main.py

# main.py
...
from esmerald.conf import settings
...

def get_application():
    app = Esmerald(
    ...
    cors_config=settings.cors_config
)
    return app 
    

Could you provide guidance on this.
Any help or documentation references would be greatly appreciated.

Thank you for your time and assistance.

[tarsil]

Yes, so an env var when it comes as a list, it won't come as a list at all, its a string split by whatever as you said but pydantic as an issue with those. My advice is to use what Lilya under Esmerald has.

Try to use like this

from lilya.environments import EnvironLoader

loader = EnvironLoader()


def validate_list(value: str) -> list[str]:
    return value.split(",").split()


class DevelopmentSettings(AppSettings):
    ... 
    allow_origins: list = loader("ALLOW_ORIGINS", cast=validate_list, default=['*'])

    @property
    def cors_config(self) -> CORSConfig:
        """
        Initial Default configuration for the CORS.
        This can be overwritten in another setting or simply override
        `allow_origins` or then override the `def cors_config()`
        property to change the behavior of the whole cors_config.
        """
        if not self.allow_origins:
            return None
        return CORSConfig(
            allow_origins=self.allow_origins,
            allow_methods=self.allow_methods,
            allow_credentials=self.allow_credentials,
        )

Also, if you have:

class DevelopmentSettings(AppSettings):
    ... 
    allow_origins: list = os.environ["ALLOW_ORIGINS"].split()

    @property
    def cors_config(self) -> CORSConfig:
        """
        Initial Default configuration for the CORS.
        This can be overwritten in another setting or simply override
        `allow_origins` or then override the `def cors_config()`
        property to change the behavior of the whole cors_config.
        """
        if not self.allow_origins:
            return None
        return CORSConfig(
            allow_origins=self.allow_origins,
            allow_methods=self.allow_methods,
            allow_credentials=self.allow_credentials,
        )

You don't need to pass it into Esmerald(....). Why? Because if you are loading the development settings via ESMERALD_SETTINGS_MODULE, then Esmerald knows that the property cors_config will be used directly from your settings :).

Pydantic has an issue with lists and casts from those coming from env vars.

Let me know if it worked for you.

Docs about Lilya Environment loader -> https://www.lilya.dev/environments/?h=en

Esmerald is on top of it, so it will work normally in your import.

[tarsil]

An example of the value of your env var

[prashikdewtale10]

Below is an example of a value that I am storing in an environment variable seprated by single space:
ALLOW_ORIGINS="https://mywebsite1.com https://mywebsite2.com"

[tarsil]

Ok. I see the issue.

Do this

https://mywebsite1.com,https://mywebsite2.com

Instead of what you have. Put a comma there. Let me know the result, please

[prashikdewtale10]

Hi @tarsil
I tried out with , which results in same.

[tarsil]

Weird. To me is passing. I will try to run some examples and put them here. Literally using the comma separated, the function I gave you with the loader and it passes

[prashikdewtale10]

@tarsil
I tried using the latest version of Esmerald with loader approach and specified the environment variable values as comma-separated, but I am still encountering the same issue.
ALLOW_ORIGINS=https://mywebsite1.com,https://mywebsite2.com

[tarsil]

Let me gather an example, publish and I will let you know

[tarsil]

@prashikdewtale10 Ok there might be something wrong on your side that I'm not aware but this is how I made it work cleanly in my codebase that also uses the cors_config.

from lilya.environments import EnvironLoade

loader: EnvironLoader = EnvironLoader()

def validate_list(value: str) -> list[str]:
    if isinstance(value, list):
        return value
    return value.split(",")


class DevelopmentSettings(AppSettings):
    ...
    @property
    def cors_config(self) -> CORSConfig:
        """
        Allow CORS for all origins.
        This is important for the frontend to communicate with the backend.
        """
        return CORSConfig(
            allow_origins=loader("ALLOWED_ORIGINS", cast=validate_list, default=["*"]),
        )

Using your example for environment vars, I exported them like this (in a linux environment):

export ALLOWED_ORIGINS=https://mywebsite1.com,https://mywebsite2.com 

You know you have an Esmerald shell you can use to check and test things, right? https://www.esmerald.dev/directives/shell/?h=shell

This might help you a lot to test. I put breakpoint in my settings to see what is what when loading the shell as well 👍🏼 .

I hope it helps

[prashikdewtale10]

I am taking values from .env file

[tarsil]

I am taking values from .env file

Same thing. The value being read is from the .env. So the .env must be loaded anyway. This is working as I could show in the example. Literally loaded, so put a break point before the return and see if your values are being properly loaded via .env and use the example because maybe something is not loading properly from the .env? Dunno, what I know is that example I used now to make it work

[prashikdewtale10]

Hi @tarsil,

As per your provided code, I noticed that the environment variable name was changed from ALLOW_ORIGINS to ALLOWED_ORIGINS. Using this change, the code is working as expected. However, when I revert the variable name back to ALLOW_ORIGINS, I encounter the same pydantic error. This behavior seems unusual to me.

Could you please provide further guidance on why this might be happening? As of now, using the ALLOWED_ORIGINS variable name works for me.

Thank you for your assistance.

[tarsil]

@prashikdewtale10 my assumption is that you had some corrupted environment values somewhere in the middle because what you changed was the name of the ENV var and it worked with the example. I can't provide details without having the whole set of your environment itself which will be impossible.

The issue was not Esmerald, this was Pydantic complaining about the values being passed not matching what was expected which means its doing the right validations since the configuration is a BaseModel.

I'm glad I could help an keep doing the great work 👍🏼