Summary
The current CORS configuration in src/middleware/corsandbody.ts likely permits broad origins or uses a permissive default. In production, CORS must be restricted to known client origins to prevent cross-site request forgery from arbitrary domains.
Proposed Solution
- Replace any wildcard or permissive CORS config with an explicit allowlist driven by env vars:
CORS_ALLOWED_ORIGINS=https://app.neurowealth.io,https://admin.neurowealth.io
- Allow only:
GET, POST, PUT, DELETE, OPTIONS
- Allow only required headers:
Content-Type, Authorization, Idempotency-Key, X-Correlation-ID
- Set
credentials: true only for authenticated routes
- Return
403 (not just a missing header) for disallowed origins
- Validate
CORS_ALLOWED_ORIGINS at startup — refuse to start if empty in production
Acceptance Criteria
Summary
The current CORS configuration in
src/middleware/corsandbody.tslikely permits broad origins or uses a permissive default. In production, CORS must be restricted to known client origins to prevent cross-site request forgery from arbitrary domains.Proposed Solution
GET, POST, PUT, DELETE, OPTIONSContent-Type, Authorization, Idempotency-Key, X-Correlation-IDcredentials: trueonly for authenticated routes403(not just a missing header) for disallowed originsCORS_ALLOWED_ORIGINSat startup — refuse to start if empty in productionAcceptance Criteria
403OPTIONSrequests respond correctly for allowed originsCORS_ALLOWED_ORIGINSvalidated at startup; missing inNODE_ENV=productionis a fatal errorCORS_ALLOWED_ORIGINSdocumented in.env.example