Configure CORS and Helmet.js for secure HTTP headers

[arandomogg]

Summary

Hardens the backend's HTTP security posture by introducing a dedicated, strongly-typed security configuration module. Cross-origin requests are now restricted to an explicit allow-list of frontend origins, and Helmet is configured with production-grade security headers and applied globally across all API routes.

Previously, CORS fell back to a permissive * wildcard and Helmet ran with bare defaults. This change makes the policy explicit, configurable through the environment, and verifiable.

Changes

• src/config/security.ts (new): Centralized security configuration.
  • getAllowedOrigins() parses the comma-separated CORS_ORIGIN environment variable into a normalized allow-list.
  • isOriginAllowed() encapsulates the allow/deny decision (permits server-to-server requests without an Origin header, supports an explicit * wildcard).
  • corsOptionsDelegate resolves the policy per request, enables credentials and preflight handling, and exposes rate-limit headers.
  • CorsNotAllowedError carries a 403 status code so the global error handler returns Forbidden rather than a generic 500.
  • helmetOptions enforces a strict Content-Security-Policy, one-year HSTS with includeSubDomains/preload, and a no-referrer policy.
• src/app.ts: Wires the new Helmet and CORS configuration, applied globally to every route. Adds trust proxy so headers and rate limiting use the correct client IP behind a proxy.
• .env.example: Documents multi-origin CORS_ORIGIN configuration.
• tests/security.test.ts (new): Unit tests covering header hardening and CORS allow/deny/preflight behaviour.

Acceptance criteria

• API versioning is preserved (/api/v1); security middleware is applied before all routes.
• No hardcoded origins: the allow-list is sourced entirely from CORS_ORIGIN.
• Production-ready: strong typings, dedicated error type, robust origin validation.

Proof of work

All unit tests pass:

Security headers (Helmet)
  v sets hardened HTTP security headers on responses
CORS policy
  v reflects the origin for allowed frontend origins
  v rejects requests from disallowed origins
  v answers preflight (OPTIONS) requests for allowed origins
  v allows non-browser requests without an Origin header

Test Suites: 2 passed, 2 total
Tests:       6 passed, 6 total

npx tsc (build) and eslint on the changed files both pass cleanly.

Closes #7

[drips-wave]

@arandomogg Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits