🐛 (CORS) Do not globally allow all origin

This is a per instance configuration. This should be set in env variables on the deployments, or instead in a .env.dev file

Author: larueli

.env

@@ -35,7 +35,7 @@ DATABASE_URL="postgresql://db_user:[email protected]:5432/db_name?serverVers
 ###< doctrine/doctrine-bundle ###
 
 ###> nelmio/cors-bundle ###
-CORS_ALLOW_ORIGIN=*
+CORS_ALLOW_ORIGIN='^https?://(localhost|127\.0\.0\.1)(:[0-9]+)?$'
 ###< nelmio/cors-bundle ###
 
 ###> sentry/sentry-symfony ###