shishantbiswas/aniwatch-api
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Enhance CORS Configuration for Production Security

Browse Source 
📌 Removed the wildcard (*) origin and replaced it with trusted origins from .env.

📌 Introduced environment variable (CORS_ALLOWED_ORIGINS) for dynamic origin management.

📌 Improved security by blocking untrusted origins and methods.

📌 Enhanced performance with maxAge for caching preflight responses.

📌 No breaking changes, as the fallback origin is set to http://localhost:4000 for development, ensuring compatibility with local setups.
This commit is contained in:
Divyansh
2024-10-01 04:55:14 +00:00
parent dbbd46a99d
commit 91fd0918c3
2 changed files with 19 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.env.example
+1
View File
@@ -1,5 +1,6 @@
DOMAIN = "aniwatchtv.to"
PORT = 4000
CORS_ALLOWED_ORIGINS = https://your-production-domain.com,https://another-trusted-domain.com
# RATE LIMIT
WINDOWMS = 1800000 # duration to track requests (in milliseconds) for rate limiting. here, 30*60*1000 = 1800000 = 30 minutes