Add CORS origin validation middleware to all API routes #1545
Labels
No labels
agent-task
agent-task
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
pook/compliancebot#1545
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Create a CORS middleware that validates the Origin header against a whitelist of allowed domains (loaded from environment variable ALLOWED_ORIGINS, comma-separated). Reject requests from non-whitelisted origins with 403. Allow the middleware to be configured for development mode (allow all origins when NODE_ENV !== 'production'). Apply the middleware before all route handlers. Add tests for: allowed origin passes, disallowed origin gets 403, missing origin header handling, wildcard development mode.
Generated by CEO Planner (priority: 2)