Apply suggestions from code review

Co-authored-by: Copilot <[email protected]>

Author: jongalloway

src/NLWebNet/Middleware/NLWebMiddleware.cs

@@ -39,7 +39,7 @@ public async Task InvokeAsync(HttpContext context)
         });
 
         // Log incoming request with structured data
-        _logger.LogInformation("Processing {Method} {Path} from {RemoteIP} with correlation ID {CorrelationId}",
+        _logger.LogDebug("Processing {Method} {Path} from {RemoteIP} with correlation ID {CorrelationId}",
             context.Request.Method, context.Request.Path,
             context.Connection.RemoteIpAddress?.ToString() ?? "unknown", correlationId);
 
@@ -70,7 +70,17 @@ public async Task InvokeAsync(HttpContext context)
 
     private static void AddCorsHeaders(HttpContext context)
     {
-        context.Response.Headers.Append("Access-Control-Allow-Origin", "*");
+        var allowedOrigins = Environment.GetEnvironmentVariable("ALLOWED_ORIGINS")?.Split(',') ?? new[] { "*" };
+        var origin = context.Request.Headers["Origin"].FirstOrDefault();
+
+        if (origin != null && allowedOrigins.Contains(origin, StringComparer.OrdinalIgnoreCase))
+        {
+            context.Response.Headers.Append("Access-Control-Allow-Origin", origin);
+        }
+        else if (allowedOrigins.Contains("*"))
+        {
+            context.Response.Headers.Append("Access-Control-Allow-Origin", "*");
+        }
         context.Response.Headers.Append("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
         context.Response.Headers.Append("Access-Control-Allow-Headers", "Content-Type, Authorization, X-Correlation-ID, X-Client-Id");
         context.Response.Headers.Append("Access-Control-Expose-Headers", "X-Correlation-ID, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset");

src/NLWebNet/Middleware/RateLimitingMiddleware.cs

@@ -47,9 +47,9 @@ public async Task InvokeAsync(HttpContext context)
 
         // Add rate limit headers
         var status = await _rateLimitingService.GetRateLimitStatusAsync(identifier);
-        context.Response.Headers.Append("X-RateLimit-Limit", _options.RequestsPerWindow.ToString());
-        context.Response.Headers.Append("X-RateLimit-Remaining", status.RequestsRemaining.ToString());
-        context.Response.Headers.Append("X-RateLimit-Reset", ((int)status.WindowResetTime.TotalSeconds).ToString());
+        context.Response.Headers["X-RateLimit-Limit"] = _options.RequestsPerWindow.ToString();
+        context.Response.Headers["X-RateLimit-Remaining"] = status.RequestsRemaining.ToString();
+        context.Response.Headers["X-RateLimit-Reset"] = ((int)status.WindowResetTime.TotalSeconds).ToString();
 
         await _next(context);
     }