- Make the value of the Access-Control-Allow-Origin response header c…

…onfigurable. - Allow only necessary headers.
motivepick · Aug 10, 2024 · 7fac039 · 7fac039
1 parent de20242
commit 7fac039
Show file tree

Hide file tree

Showing 4 changed files with 11 additions and 3 deletions.
diff --git a/src/main/kotlin/org/motivepick/config/SecurityConfig.kt b/src/main/kotlin/org/motivepick/config/SecurityConfig.kt
@@ -53,9 +53,9 @@ internal class SecurityConfig {
             it.configurationSource {
                 val configuration = CorsConfiguration()
                 configuration.allowCredentials = true
-                configuration.allowedOriginPatterns = listOf("*")
+                configuration.allowedOriginPatterns = listOf(config.corsAllowedOriginPattern)
                 configuration.allowedMethods = listOf("GET", "POST", "PUT", "DELETE")
-                configuration.allowedHeaders = listOf("*")
+                configuration.allowedHeaders = listOf("Content-Type")
                 configuration
             }
         }

diff --git a/src/main/kotlin/org/motivepick/config/ServerConfig.kt b/src/main/kotlin/org/motivepick/config/ServerConfig.kt
@@ -19,5 +19,8 @@ class ServerConfig(
         val logoutSuccessUrl: String,
 
         @Value("\${cookie.domain}")
-        val cookieDomain: String
+        val cookieDomain: String,
+
+        @Value("\${cors.allowedOriginPattern}")
+        val corsAllowedOriginPattern: String
 )
diff --git a/src/main/resources/application-prod.yml b/src/main/resources/application-prod.yml
@@ -20,3 +20,5 @@ cookie.domain: milestone.yaskovdev.com
 jwt.token:
   issuer: https://api.milestone.yaskovdev.com
   signing.key: ${JWT_TOKEN_SIGNING_KEY}
+
+cors.allowedOriginPattern: 'https://milestone.yaskovdev.com'
diff --git a/src/main/resources/application.yml b/src/main/resources/application.yml
@@ -31,3 +31,6 @@ authentication.success.url.mobile: 'motive://'
 
 springdoc.packagesToScan: 'org.motivepick'
 springdoc.pathsToMatch: '/**'
+
+# This is normally the origin of the Web app or * (if not Prod)
+cors.allowedOriginPattern: '*'