Merge pull request #53 from DokaIzk/feat/CORS-allow-list

Added CORS allow list

Author: ritik4ever

backend/.env.example

@@ -1,6 +1,9 @@
 PORT=3000
 ALLOWED_ASSETS="USDC,XLM,ARS"
 
+# CORS allowed origins (comma-separated)
+CORS_ALLOWED_ORIGINS="http://localhost:5173"
+
 # Soroban RPC endpoint for event indexing
 SOROBAN_RPC_URL=https://soroban-testnet.stellar.org:443
 CONTRACT_ID=

backend/src/config.ts

@@ -1,9 +1,19 @@
 import "dotenv/config";
 
+const parseOrigins = (originsStr: string): string[] => {
+  return originsStr
+    .split(",")
+    .map((s) => s.trim())
+    .filter(Boolean);
+};
+
 export const config = {
   port: Number(process.env.PORT ?? 3001),
   allowedAssets: (process.env.ALLOWED_ASSETS ?? "USDC,XLM")
     .split(",")
     .map((s) => s.trim().toUpperCase())
     .filter(Boolean),
+  corsAllowedOrigins: parseOrigins(
+    process.env.CORS_ALLOWED_ORIGINS ?? "http://localhost:5173"
+  ),
 };

backend/src/index.ts

@@ -41,7 +41,12 @@ type CampaignListItem = ReturnType<typeof calculateProgress> extends infer Progr
 // Initialize DB
 initCampaignStore();
 
-app.use(cors());
+app.use(
+  cors({
+    origin: config.corsAllowedOrigins,
+    credentials: true,
+  })
+);
 app.use(express.json());
 
 // Request ID middleware

backend/tsconfig.json

@@ -13,8 +13,7 @@
     "forceConsistentCasingInFileNames": true,
     "resolveJsonModule": true,
     "declaration": true,
-    "ignoreDeprecations": "6.0"
-  },
+
   "include": ["src/**/*"],
   "exclude": ["node_modules", "dist"]
 }