Merge branch 'security/trust-proxy-cors-hardening' into 'develop'

security: make trust proxy and CORS origins configurable

See merge request !7

.env.example

@@ -22,4 +22,8 @@ MAIL_SECURE=false
 MAIL_USER=your_gmail_user@gmail.com
 MAIL_PASS=your_gmail_app_password
 MAIL_FROM="FinWise <noreply@gmail.com>"
-APP_URL=http://localhost:7777
+APP_URL=http://localhost:7777
\ No newline at end of file
+
+TRUST_PROXY=false
+
+ALLOWED_ORIGINS=http://localhost:7777,http://localhost:3000,http://localhost:5173
\ No newline at end of file

src/app.ts

@@ -8,13 +8,26 @@ import { errorMiddleware, notFoundMiddleware } from './middlewares/error.middlew
 import routes from './routes';
 import { swaggerSpec, swaggerOptions } from './config/swagger.config';
 import { rateLimitMiddleware } from './middlewares/rate-limit.middleware';
+import { envConfig } from './config/env.config';
 
 const app = express();
 
-app.set('trust proxy', true);
+app.set('trust proxy', envConfig.trustProxy);
 
 app.use(helmet({ contentSecurityPolicy: false, }),);
-app.use(cors());
+
+const corsOptions: cors.CorsOptions = {
+  origin: (origin, callback) => {
+    const allowed = envConfig.cors.allowedOrigins;
+    if (allowed.includes('*') || !origin || allowed.includes(origin)) {
+      callback(null, true);
+    } else {
+      callback(null, false);
+    }
+  },
+  credentials: true,
+};
+app.use(cors(corsOptions));
 app.use(morgan('dev'));
 app.use(express.json());
 app.use(express.urlencoded({ extended: true }));

src/config/env.config.ts

@@ -17,4 +17,18 @@ export const envConfig = {
     accessExpiresIn: process.env.JWT_ACCESS_EXPIRES_IN || '1d',
     refreshExpiresIn: process.env.JWT_REFRESH_EXPIRES_IN || '7d',
   },
+  trustProxy: (() => {
+    const val = process.env.TRUST_PROXY;
+    if (!val) return false;
+    if (val === 'true') return true;
+    if (val === 'false') return false;
+    if (/^\d+$/.test(val)) return parseInt(val, 10);
+    if (val.includes(',')) return val.split(',').map(s => s.trim());
+    return val;
+  })(),
+  cors: {
+    allowedOrigins: process.env.ALLOWED_ORIGINS
+      ? process.env.ALLOWED_ORIGINS.split(',').map(s => s.trim())
+      : ['*'],
+  },
 };