✦ Is your feature request related to a problem?
Currently, the backend CORS configuration is permissive and allows requests from multiple origins without strict validation. This can expose sensitive API endpoints to unauthorized cross-origin requests, creating potential security risks.
⟡ Describe the Proposed Solution
Introduce a secure CORS configuration that restricts requests to a whitelist of trusted domains (e.g., debugra.tech for production and localhost:5173 for development).
Add support for an environment variable (ALLOWED_ORIGINS) to configure allowed domains dynamically.
Reject requests from untrusted origins with a clear error response.
Ensure credentials are only shared with trusted origins.
✦ Describe Alternatives Considered
Keeping the current permissive setup (not secure).
Using a regex-based origin check (flexible but harder to maintain).
Proxying all requests through a single trusted domain (adds complexity).
🎨 Visual Mockup/Sketches (Optional)
Not applicable for backend-only changes.
⟡ Additional Context
This change strengthens backend security by preventing unauthorized cross-origin requests. It aligns with best practices for API hardening and complements other ongoing security improvements (JWT rotation, input validation, API key protection).
✦ Is your feature request related to a problem?
Currently, the backend CORS configuration is permissive and allows requests from multiple origins without strict validation. This can expose sensitive API endpoints to unauthorized cross-origin requests, creating potential security risks.
⟡ Describe the Proposed Solution
Introduce a secure CORS configuration that restricts requests to a whitelist of trusted domains (e.g., debugra.tech for production and localhost:5173 for development).
Add support for an environment variable (ALLOWED_ORIGINS) to configure allowed domains dynamically.
Reject requests from untrusted origins with a clear error response.
Ensure credentials are only shared with trusted origins.
✦ Describe Alternatives Considered
Keeping the current permissive setup (not secure).
Using a regex-based origin check (flexible but harder to maintain).
Proxying all requests through a single trusted domain (adds complexity).
🎨 Visual Mockup/Sketches (Optional)
Not applicable for backend-only changes.
⟡ Additional Context
This change strengthens backend security by preventing unauthorized cross-origin requests. It aligns with best practices for API hardening and complements other ongoing security improvements (JWT rotation, input validation, API key protection).