[Backend] Add CORS Configuration and HTTPS Enforcement

[devJaja]

🎯 Objective

Add CORS configuration, HTTPS enforcement, and fix the hardcoded WebSocket URL to prevent security vulnerabilities in transport and origin control.

---

📁 Files to Modify

Action	File Path	Description
Modify	backend/src/api/app.ts	Add CORS middleware
Modify	backend/src/config/index.ts	Add ALLOWED_ORIGINS config
Modify	backend/.env.example	Document ALLOWED_ORIGINS
Modify	frontend/src/hooks/useTaskMonitor.ts	Fix hardcoded ws://localhost:3001

📁 Files to Create

Action	File Path	Description
Create	backend/src/api/middleware/cors.ts	CORS configuration factory

---

🔍 Current Vulnerabilities

1. No CORS (app.ts)

// CURRENT — cors dependency exists but is never used
// Package.json includes "cors" but no app.use(cors(...)) call
// Server accepts requests from ANY origin

2. No HTTPS enforcement

// Server listens on plain HTTP
// No HSTS headers
// No redirect middleware

3. Hardcoded WebSocket URL (useTaskMonitor.ts ~line 102)

// CURRENT — Hardcoded to localhost, plain WebSocket
const ws = new WebSocket('ws://localhost:3001/tasks/${taskId}/stream');

---

✅ Expected Fix

Backend: CORS Configuration

// backend/src/api/middleware/cors.ts
import cors from 'cors';

export function createCorsMiddleware() {
  const allowedOrigins = process.env.ALLOWED_ORIGINS?.split(',') || ['http://localhost:3000'];

  return cors({
    origin: (origin, callback) => {
      if (!origin || allowedOrigins.includes(origin)) {
        callback(null, true);
      } else {
        callback(new Error('Not allowed by CORS'));
      }
    },
    credentials: true,
    methods: ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS'],
    allowedHeaders: ['Content-Type', 'Authorization', 'walletpublickey', 'x-challenge', 'x-signature'],
  });
}

Backend: Mount in app.ts

import { createCorsMiddleware } from './middleware/cors';

app.use(createCorsMiddleware());

Frontend: Fix WebSocket URL (useTaskMonitor.ts)

// BEFORE
const ws = new WebSocket(`ws://localhost:3001/tasks/${taskId}/stream`);

// AFTER
const protocol = window.location.protocol === 'https:' ? 'wss:' : 'ws:';
const host = import.meta.env.VITE_WS_HOST || window.location.host;
const ws = new WebSocket(`${protocol}//${host}/tasks/${taskId}/stream`);

---

📁 Reference Files

File Path	Purpose
backend/package.json	cors dependency already listed
backend/src/api/app.ts	Express app setup
backend/src/config/index.ts	Zod-based env config
backend/.env.example	Environment template
frontend/src/hooks/useTaskMonitor.ts (line ~102)	Hardcoded WebSocket URL
frontend/src/services/api.ts	API base URL config reference

---

✅ Acceptance Criteria

• Create backend/src/api/middleware/cors.ts with configurable origins
• Mount CORS middleware in backend/src/api/app.ts
• Add ALLOWED_ORIGINS to backend/src/config/index.ts
• Document ALLOWED_ORIGINS in backend/.env.example
• Fix WebSocket URL in frontend/src/hooks/useTaskMonitor.ts to use dynamic protocol
• Add HSTS header middleware for production
• Add test: verify CORS blocks unauthorized origins
• Add test: verify CORS allows configured origins

[nurudeenheroic]

Hi! I've gone through the issue and have a clear approach to solving it. I'd appreciate the chance to contribute.

[malaysiaonelove]

Hi maintain,I will love to work on this issue,I have an experience and I have already reviewed the issue please assigned me to it and I will give a good result.

[DevSolex]

Hi Maintainer,

I’m a smart contract and full-stack developer and would love to contribute to this issue. I’m an experienced contributor with hands-on expertise in Rust, Soroban, Cairo, and TypeScript.

I’m passionate about building secure, scalable blockchain solutions, with a strong emphasis on writing clean and maintainable code. Based on the scope of this issue, I’m confident I can deliver a complete solution within 24 hours of assignment.

I’d greatly appreciate the opportunity to contribute and help move this forward.

[grantfox-oss]

🎉 This issue has been marked as completed on GrantFox as part of the Official Campaign | FWC26 campaign!

@DevSolex's PR #199 was approved and merged by @devJaja.

🏆 @DevSolex: You earned 35 FoxPoints for this contribution! Your current tier: Explorer (837 total points). Track your full progress on GrantFox.

👏 Great work, @DevSolex! Keep contributing to Epta-Node.