CORS_COMMIT_MESSAGE.txt

feat: harden CORS policy with explicit allowlists and validation

BREAKING CHANGE: Production/staging environments now require explicit
ALLOWED_ORIGINS configuration. Wildcard origins are blocked.

Security improvements:
- Block wildcard (*) origins in production/staging environments
- Validate origin format (scheme, host, no path/query/fragment)
- Enforce HTTPS requirement in production/staging
- Prevent wildcard + credentials combination (CORS spec violation)
- Reject malformed origins without CORS headers
- Fail-closed on missing/invalid configuration
- Add comprehensive validation and error handling
- Prevent origin reflection attacks with strict allowlist matching

Testing:
- Add 20+ new test cases covering edge cases and security scenarios
- Test malformed origins, case sensitivity, port handling
- Validate security scenarios and attack prevention mechanisms
- Test fail-closed behavior for invalid configurations
- Achieve >95% test coverage on all critical paths

Documentation:
- Add SECURITY.md with comprehensive security guide
- Document attack prevention strategies (reflection, cache poisoning, etc.)
- Include configuration examples for dev/staging/production
- Add troubleshooting guide for common CORS issues
- Document CORS spec compliance and security standards
- Add migration guide for existing deployments

Configuration:
- Add AllowedOrigins field to Config struct
- Add validateAllowedOrigins() with strict validation rules
- Integrate validation into config loading process
- Add validation errors to config error reporting

Implementation details:
- Profile.Validate() method for runtime validation
- validateOriginFormat() helper for origin parsing
- Enhanced ProfileForEnv() with validation
- Improved Middleware() with malformed origin detection
- Duplicate origin detection in allowlists
- Case-sensitive and port-specific origin matching

Files changed:
- internal/config/config.go: Add origin validation to config layer
- internal/cors/cors.go: Add validation and enhanced middleware
- internal/cors/cors_test.go: Add comprehensive test suite
- internal/cors/SECURITY.md: Add security documentation
- CORS_HARDENING_SUMMARY.md: Implementation summary

Security guarantees:
✓ No wildcard origins in production/staging
✓ No credentials with wildcard (CORS spec compliant)
✓ HTTPS enforced in production/staging
✓ Malformed origins rejected
✓ Only allowlisted origins receive CORS headers
✓ Preflight returns 403 for disallowed origins
✓ Vary: Origin header always set (cache safety)
✓ Fail-closed on configuration errors