Add strict CORS allowlist with fail-closed default #105

Merged

pook merged 1 commit from feature/cors-allowlist into main

2026-04-09 06:14:09 -04:00

pook commented

2026-04-08 18:58:32 -04:00

Owner

Summary

Configure CORS middleware to only allow origins from ALLOWED_ORIGINS env var (comma-separated)
Default to no origins allowed (fail-closed) when env var is missing
Restrict allowed methods to GET, POST, OPTIONS only
Add preflight caching with Access-Control-Max-Age: 86400 (24 hours)
Add ALLOWED_ORIGINS to .env.sample for documentation

Test plan

Unit tests cover allowed origin receiving CORS headers
Unit tests cover disallowed origin NOT receiving CORS headers
Unit tests cover empty allowlist blocking all origins
Unit tests cover preflight returning correct methods and max-age
All 8 tests pass (bun test packages/api/tests/unit/cors.test.ts)

🤖 Generated with Claude Code

## Summary - Configure CORS middleware to only allow origins from `ALLOWED_ORIGINS` env var (comma-separated) - Default to **no origins allowed** (fail-closed) when env var is missing - Restrict allowed methods to `GET`, `POST`, `OPTIONS` only - Add preflight caching with `Access-Control-Max-Age: 86400` (24 hours) - Add `ALLOWED_ORIGINS` to `.env.sample` for documentation ## Test plan - [x] Unit tests cover allowed origin receiving CORS headers - [x] Unit tests cover disallowed origin NOT receiving CORS headers - [x] Unit tests cover empty allowlist blocking all origins - [x] Unit tests cover preflight returning correct methods and max-age - [x] All 8 tests pass (`bun test packages/api/tests/unit/cors.test.ts`) 🤖 Generated with [Claude Code](https://claude.com/claude-code)

pook added 1 commit

2026-04-08 18:58:32 -04:00

Add strict CORS allowlist with fail-closed default 3243f3fb04

Configure CORS middleware to only allow origins specified in ALLOWED_ORIGINS
env var (comma-separated). When the env var is missing, no origins are
allowed (fail-closed). Restrict methods to GET/POST/OPTIONS, enable
preflight caching (max-age 86400), and add unit tests covering allow/deny.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>