From e2adce33b8be697a40b9882d83989ac3beb769fd Mon Sep 17 00:00:00 2001
From: Michael SCHAL <michaelschal@gmail.com>
Date: Sat, 18 Apr 2026 07:25:24 +0200
Subject: [PATCH] security: strict CORS whitelist + reduce JSON body limit to
 1mb

Replace permissive CORS with origin whitelist driven by CORS_ORIGIN env
var. Drop body size limit from 10mb to 1mb to reduce DoS surface.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
---
 backend/src/index.ts | 25 ++++++++++++++++++++++---
 1 file changed, 22 insertions(+), 3 deletions(-)

diff --git a/backend/src/index.ts b/backend/src/index.ts
index a449d42..b752b8a 100644
--- a/backend/src/index.ts
+++ b/backend/src/index.ts
@@ -36,9 +36,28 @@ const discoveryLimiter = rateLimit({
 });
 
 // Middleware
-app.use(cors());
-app.use(express.json());
-app.use(express.urlencoded({ limit: '10mb', extended: true }));
+const allowedOrigins = (process.env.CORS_ORIGIN || '')
+  .split(',')
+  .map((s) => s.trim())
+  .filter(Boolean);
+
+app.use(
+  cors({
+    origin: (origin, callback) => {
+      // Allow same-origin (no Origin header) and whitelisted origins
+      if (!origin) return callback(null, true);
+      if (allowedOrigins.length === 0 || allowedOrigins.includes(origin)) {
+        return callback(null, true);
+      }
+      return callback(new Error('Not allowed by CORS'));
+    },
+    credentials: true,
+    methods: ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS'],
+    allowedHeaders: ['Content-Type', 'Authorization'],
+  })
+);
+app.use(express.json({ limit: '1mb' }));
+app.use(express.urlencoded({ limit: '1mb', extended: true }));
 
 // Initialize databases on startup
 let isInitialized = false;