feat(security): implement configurable CORS allowed origins

Author: diangogav

src/config/index.ts

@@ -1,39 +1,40 @@
 export const config = {
-	redis: {
-		use: process.env.USE_REDIS === "true",
-		uri: process.env.REDIS_URI,
-	},
-	env: process.env.NODE_ENV,
-	adminApiKey: process.env.ADMIN_API_KEY,
-	postgres: {
-		username: process.env.POSTGRES_USER,
-		password: process.env.POSTGRES_PASSWORD,
-		database: process.env.POSTGRES_DB,
-		host: process.env.POSTGRES_HOST ?? "localhost",
-		port: process.env.POSTGRES_PORT ? Number(process.env.POSTGRES_PORT) : 5432,
-	},
-	ranking: {
-		enabled: process.env.RANK_ENABLED === "true",
-	},
-	season: Number(process.env.SEASON),
-	rateLimit: {
-		enabled: process.env.RATE_LIMIT_ENABLED === "true",
-		limit: Number(process.env.RATE_LIMIT),
-		window: Number(process.env.RATE_LIMIT_WINDOW),
-	},
-	servers: {
-		host: {
-			port: Number(process.env.HOST_PORT),
-		},
-		mercury: {
-			port: Number(process.env.MERCURY_PORT),
-		},
-		http: {
-			port: Number(process.env.HTTP_PORT),
-		},
-		websocket: {
-			port: Number(process.env.WEBSOCKET_PORT),
-			duelPort: Number(process.env.WEBSOCKET_DUEL_PORT) || 4001,
-		},
-	},
+  redis: {
+    use: process.env.USE_REDIS === "true",
+    uri: process.env.REDIS_URI,
+  },
+  env: process.env.NODE_ENV,
+  adminApiKey: process.env.ADMIN_API_KEY,
+  postgres: {
+    username: process.env.POSTGRES_USER,
+    password: process.env.POSTGRES_PASSWORD,
+    database: process.env.POSTGRES_DB,
+    host: process.env.POSTGRES_HOST ?? "localhost",
+    port: process.env.POSTGRES_PORT ? Number(process.env.POSTGRES_PORT) : 5432,
+  },
+  ranking: {
+    enabled: process.env.RANK_ENABLED === "true",
+  },
+  season: Number(process.env.SEASON),
+  allowedOrigins: process.env.ALLOWED_ORIGINS?.split(",") ?? ["*"],
+  rateLimit: {
+    enabled: process.env.RATE_LIMIT_ENABLED === "true",
+    limit: Number(process.env.RATE_LIMIT),
+    window: Number(process.env.RATE_LIMIT_WINDOW),
+  },
+  servers: {
+    host: {
+      port: Number(process.env.HOST_PORT),
+    },
+    mercury: {
+      port: Number(process.env.MERCURY_PORT),
+    },
+    http: {
+      port: Number(process.env.HTTP_PORT),
+    },
+    websocket: {
+      port: Number(process.env.WEBSOCKET_PORT),
+      duelPort: Number(process.env.WEBSOCKET_DUEL_PORT) || 4001,
+    },
+  },
 };

src/http-server/Server.ts

@@ -6,30 +6,43 @@ import { createDirectoryIfNotExists } from "../utils";
 import { loadRoutes } from "./routes";
 
 export class Server {
-	private readonly app: Express;
-	private readonly logger: Logger;
+  private readonly app: Express;
+  private readonly logger: Logger;
 
-	constructor(logger: Logger) {
-		this.logger = logger;
-		this.app = express();
-		this.app.use(express.json());
-		this.app.use((req, res, next) => {
-			res.header("Access-Control-Allow-Origin", "*");
-			res.header("Access-Control-Allow-Methods", "GET, POST, OPTIONS, PUT, DELETE");
-			res.header("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept, Authorization");
-			if (req.method === "OPTIONS") {
-				res.sendStatus(200);
-			} else {
-				next();
-			}
-		});
-		loadRoutes(this.app, this.logger);
-	}
+  constructor(logger: Logger) {
+    this.logger = logger;
+    this.app = express();
+    this.app.use(express.json());
+    this.app.use((req, res, next) => {
+      const origin = req.headers.origin;
+      if (
+        origin &&
+        (config.allowedOrigins.includes("*") ||
+          config.allowedOrigins.includes(origin))
+      ) {
+        res.header("Access-Control-Allow-Origin", origin);
+      }
+      res.header(
+        "Access-Control-Allow-Methods",
+        "GET, POST, OPTIONS, PUT, DELETE",
+      );
+      res.header(
+        "Access-Control-Allow-Headers",
+        "Origin, X-Requested-With, Content-Type, Accept, Authorization, admin-api-key",
+      );
+      if (req.method === "OPTIONS") {
+        res.sendStatus(200);
+      } else {
+        next();
+      }
+    });
+    loadRoutes(this.app, this.logger);
+  }
 
-	async initialize(): Promise<void> {
-		await createDirectoryIfNotExists("./config");
-		this.app.listen(config.servers.http.port, () => {
-			this.logger.info(`Server listen in port ${config.servers.http.port}`);
-		});
-	}
+  async initialize(): Promise<void> {
+    await createDirectoryIfNotExists("./config");
+    this.app.listen(config.servers.http.port, () => {
+      this.logger.info(`Server listen in port ${config.servers.http.port}`);
+    });
+  }
 }