feat: implement production-safe CORS configuration with allowlist and…

[sudo-robi]

closes #883

CORS Configuration Overhaul

This PR implements a production-safe CORS configuration with these key improvements:

Key Changes:

1. Configurable Origin Allowlist:

   • Created cors.config.ts with environment-based origin validation
   • Supports comma-separated origin lists in CORS_ORIGIN
   • Provides sensible defaults for development/test environments

2. Production-Ready Security:

   • Explicit origin allowlist (no wildcard in production)
   • Proper credential handling
   • Preflight request support
   • Secure headers configuration

3. Testing:

   • Added SuperTest suite for CORS behavior
   • Tests preflight requests and simple cross-origin requests
   • Verifies both allowed and blocked origins

4. Documentation:

   • Updated .env.example with CORS configuration guidance
   • Added environment variable documentation

Implementation Details:

• Replaced generic cors() middleware with custom configuration
• Updated GraphQL server to use the same CORS configuration
• Added logging for rejected origins
• Maintained backward compatibility for development environments

Testing:

• Run tests with npm test (or npm run test:watch)
• Verify CORS behavior with:

  curl -H "Origin: http://localhost:3000" -I http://localhost:8080/health
  curl -H "Origin: http://evil.example" -I http://localhost:8080/health

Review Checklist:

• Verify production CORS_ORIGIN is properly configured
• Confirm all development origins are properly listed
• Verify preflight requests work as expected
• Check that unlisted origins are properly rejected
• Confirm credential handling is correct

This description provides:

1. Clear context about what was changed
2. Explanation of the security improvements
3. Implementation details for reviewers
4. Testing instructions
5. A review checklist for the team

[vercel]

@sudo-robi is attempting to deploy a commit to the Ayomide Adeniran's projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@sudo-robi Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[ayomideadeniran]

pr under review

[sudo-robi]

@ayomideadeniran i have resolved the issue

[Copilot]

Pull request overview

Implements an environment-driven CORS allowlist intended to make backend CORS behavior production-safe (closing #883) by replacing permissive defaults with explicit origin validation and adding automated coverage.

Changes:

• Added a centralized CORS middleware factory (backend/src/config/cors.config.ts) with env-based allowlist parsing.
• Switched the main Express app to use the new CORS middleware and added a SuperTest suite to verify preflight + simple requests.
• Updated environment documentation and refreshed backend dependency lock entries.

Reviewed changes

Copilot reviewed 7 out of 9 changed files in this pull request and generated 10 comments.

Show a summary per file

File	Description
package.json	Adds root-level dependencies relevant to Express/CORS/testing.
backend/tests/cors.test.ts	Adds SuperTest coverage for allowed vs blocked origins and preflight behavior.
backend/src/index.ts	Replaces generic cors() with createCorsMiddleware() at the app level.
backend/src/graphql/server.ts	Switches GraphQL middleware chain to use the shared CORS middleware.
backend/src/config/cors.config.ts	Introduces env-driven allowlist parsing and CORS options.
backend/package.json	Updates scripts and devDependencies for testing/types.
backend/package-lock.json	Updates lockfile entries for test tooling dependencies.
.env.example	Documents new CORS environment variables and examples.

Files not reviewed (1)

• backend/package-lock.json: Generated file

Suppressed comments (3)

backend/package-lock.json:4983

• This lockfile introduces registry.npmmirror.com for @types/supertest, while the rest of the lockfile mostly uses registry.npmjs.org. Mixed registries can break installs in CI/CD environments that cannot reach the mirror domain.
  backend/package-lock.json:11354
• This lockfile introduces registry.npmmirror.com for semver, while the rest of the lockfile mostly uses registry.npmjs.org. Mixed registries can break installs in CI/CD environments that cannot reach the mirror domain.
  backend/package-lock.json:12331
• This lockfile introduces registry.npmmirror.com for ts-jest, while the rest of the lockfile mostly uses registry.npmjs.org. Mixed registries can break installs in CI/CD environments that cannot reach the mirror domain.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.