fix(cors): reject wildcard origin with credentials

.env.example

@@ -6,6 +6,10 @@ MONGODB_URI="mongodb://localhost:27017/acbu_db"
 RABBITMQ_URL="amqp://guest:guest@localhost:5672"
 JWT_SECRET="dev-jwt-secret-change-me"
 
+# CORS — comma-separated exact origins (no *; required in production).
+# Unset in development defaults to http://localhost:3000
+# CORS_ORIGIN=http://localhost:3000,https://app.example.com
+
 # B-058: PII field-level encryption key (AES-256-GCM).
 # Must be a 64-character hex string (32 bytes). Required in production.
 # Generate: node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"

src/config/corsOrigins.ts

@@ -0,0 +1,63 @@
+/** Default browser origin for local development when CORS_ORIGIN is unset. */
+export const DEFAULT_DEV_CORS_ORIGIN = "http://localhost:3000";
+
+/**
+ * Parse and validate CORS_ORIGIN for credentialed cross-origin requests.
+ * Wildcard (*) is rejected: browsers forbid ACAO:* with Allow-Credentials.
+ */
+export function parseCorsOrigins(raw: string | undefined, nodeEnv: string): string[] {
+  const trimmed = raw?.trim();
+
+  if (!trimmed) {
+    if (nodeEnv === "production") {
+      throw new Error(
+        "CORS_ORIGIN is required in production. Set a comma-separated list of exact origins " +
+          "(e.g. https://app.example.com). Wildcard * is not allowed with credentials.",
+      );
+    }
+    return [DEFAULT_DEV_CORS_ORIGIN];
+  }
+
+  const origins = trimmed
+    .split(",")
+    .map((entry) => entry.trim())
+    .filter(Boolean);
+
+  if (origins.length === 0) {
+    throw new Error(
+      "CORS_ORIGIN must list at least one origin when set (wildcard * is not allowed).",
+    );
+  }
+
+  if (origins.some((origin) => origin === "*")) {
+    throw new Error(
+      "CORS_ORIGIN must not contain wildcard (*). List explicit origins; " +
+        "credentialed responses require Access-Control-Allow-Origin to match the request origin.",
+    );
+  }
+
+  const normalized: string[] = [];
+  for (const origin of origins) {
+    let url: URL;
+    try {
+      url = new URL(origin);
+    } catch {
+      throw new Error(
+        `Invalid CORS origin "${origin}". Use full origins such as https://app.example.com`,
+      );
+    }
+    if (url.protocol !== "http:" && url.protocol !== "https:") {
+      throw new Error(
+        `Invalid CORS origin "${origin}". Only http:// and https:// origins are supported.`,
+      );
+    }
+    if (url.username || url.password || url.pathname !== "/" || url.search || url.hash) {
+      throw new Error(
+        `Invalid CORS origin "${origin}". Provide scheme, host, and port only (no path or credentials).`,
+      );
+    }
+    normalized.push(url.origin);
+  }
+
+  return [...new Set(normalized)];
+}

src/config/env.ts

@@ -1,5 +1,6 @@
 import dotenv from "dotenv";
 import { z } from "zod";
+import { parseCorsOrigins } from "./corsOrigins";
 
 dotenv.config();
 
@@ -422,6 +423,6 @@ export const config = {
     maxTokensPerRequest: env.OPENAI_MAX_TOKENS_PER_REQUEST,
   },
 
-  // CORS
-  corsOrigin: process.env.CORS_ORIGIN?.split(",") || [],
+  // CORS — explicit origins only; wildcard * is rejected (incompatible with credentials)
+  corsOrigin: parseCorsOrigins(process.env.CORS_ORIGIN, env.NODE_ENV),
 };

src/middleware/cors.ts

@@ -1,17 +1,47 @@
-import cors from "cors";
+import cors, { type CorsOptions } from "cors";
 import { config } from "../config/env";
 
-export const corsMiddleware = cors({
-  origin: (origin, callback) => {
-    if (
-      !origin || config.corsOrigin.includes(origin)
-    ) {
-      callback(null, true);
-    } else {
-      callback(new Error("Not allowed by CORS"));
-    }
-  },
+/**
+ * Resolve the Access-Control-Allow-Origin value for a request.
+ * Returns the exact origin string when allowed, false when denied,
+ * or null when the request has no Origin (non-browser / same-origin tools).
+ */
+export function resolveCorsOrigin(
+  requestOrigin: string | undefined,
+  allowedOrigins: readonly string[],
+): string | false | null {
+  if (!requestOrigin) {
+    return null;
+  }
+  if (allowedOrigins.includes(requestOrigin)) {
+    return requestOrigin;
+  }
+  return false;
+}
+
+const corsOptionsBase: Omit<CorsOptions, "origin"> = {
   credentials: true,
   methods: ["GET", "POST", "PUT", "DELETE", "PATCH", "OPTIONS"],
   allowedHeaders: ["Content-Type", "Authorization", "X-API-Key"],
-});
+};
+
+/** Build CORS middleware for a fixed allowlist (used in tests and production). */
+export function createCorsMiddleware(allowedOrigins: readonly string[]) {
+  return cors({
+    ...corsOptionsBase,
+    origin: (origin, callback) => {
+      const resolved = resolveCorsOrigin(origin, allowedOrigins);
+      if (resolved === null) {
+        callback(null, true);
+        return;
+      }
+      if (resolved === false) {
+        callback(new Error("Not allowed by CORS"));
+        return;
+      }
+      callback(null, resolved);
+    },
+  });
+}
+
+export const corsMiddleware = createCorsMiddleware(config.corsOrigin);

tests/cors.test.ts

@@ -0,0 +1,101 @@
+import express from "express";
+import request from "supertest";
+import { parseCorsOrigins, DEFAULT_DEV_CORS_ORIGIN } from "../src/config/corsOrigins";
+import { createCorsMiddleware, resolveCorsOrigin } from "../src/middleware/cors";
+
+describe("parseCorsOrigins", () => {
+  it("defaults to localhost in non-production when unset", () => {
+    expect(parseCorsOrigins(undefined, "development")).toEqual([DEFAULT_DEV_CORS_ORIGIN]);
+    expect(parseCorsOrigins(undefined, "test")).toEqual([DEFAULT_DEV_CORS_ORIGIN]);
+  });
+
+  it("requires explicit origins in production when unset", () => {
+    expect(() => parseCorsOrigins(undefined, "production")).toThrow(
+      /CORS_ORIGIN is required in production/,
+    );
+  });
+
+  it("rejects wildcard *", () => {
+    expect(() => parseCorsOrigins("*", "development")).toThrow(/wildcard/i);
+    expect(() => parseCorsOrigins("https://a.com,*", "development")).toThrow(/wildcard/i);
+  });
+
+  it("parses, trims, and deduplicates comma-separated origins", () => {
+    expect(
+      parseCorsOrigins(
+        " https://app.example.com ,https://admin.example.com,https://app.example.com ",
+        "development",
+      ),
+    ).toEqual(["https://app.example.com", "https://admin.example.com"]);
+  });
+
+  it("normalizes valid origins to URL.origin form", () => {
+    expect(parseCorsOrigins("https://app.example.com:443", "development")).toEqual([
+      "https://app.example.com",
+    ]);
+  });
+
+  it("rejects origins with paths", () => {
+    expect(() => parseCorsOrigins("https://app.example.com/dashboard", "development")).toThrow(
+      /scheme, host, and port only/i,
+    );
+  });
+});
+
+describe("resolveCorsOrigin", () => {
+  const allowed = ["http://localhost:3000", "https://app.example.com"];
+
+  it("returns null when Origin header is absent", () => {
+    expect(resolveCorsOrigin(undefined, allowed)).toBeNull();
+  });
+
+  it("returns the request origin when it is on the allowlist", () => {
+    expect(resolveCorsOrigin("https://app.example.com", allowed)).toBe("https://app.example.com");
+  });
+
+  it("returns false for origins not on the allowlist", () => {
+    expect(resolveCorsOrigin("https://evil.example.com", allowed)).toBe(false);
+  });
+});
+
+describe("createCorsMiddleware", () => {
+  const allowedOrigin = "http://localhost:3000";
+
+  function buildApp(allowedOrigins: string[]) {
+    const app = express();
+    app.use(createCorsMiddleware(allowedOrigins));
+    app.get("/ping", (_req, res) => {
+      res.json({ ok: true });
+    });
+    return app;
+  }
+
+  it("reflects an allowed Origin (never *) with credentials", async () => {
+    const res = await request(buildApp([allowedOrigin]))
+      .get("/ping")
+      .set("Origin", allowedOrigin)
+      .expect(200);
+
+    expect(res.headers["access-control-allow-origin"]).toBe(allowedOrigin);
+    expect(res.headers["access-control-allow-origin"]).not.toBe("*");
+    expect(res.headers["access-control-allow-credentials"]).toBe("true");
+  });
+
+  it("rejects disallowed cross-origin requests", async () => {
+    await request(buildApp([allowedOrigin]))
+      .get("/ping")
+      .set("Origin", "https://evil.example.com")
+      .expect(500);
+  });
+
+  it("handles preflight OPTIONS with reflected origin", async () => {
+    const res = await request(buildApp([allowedOrigin]))
+      .options("/ping")
+      .set("Origin", allowedOrigin)
+      .set("Access-Control-Request-Method", "GET")
+      .expect(204);
+
+    expect(res.headers["access-control-allow-origin"]).toBe(allowedOrigin);
+    expect(res.headers["access-control-allow-credentials"]).toBe("true");
+  });
+});

tests/env.test.ts

@@ -46,4 +46,9 @@ describe("env validation", () => {
     process.env.LOG_LEVEL = "invalid_level";
     expect(() => require("../src/config/env")).toThrow(/LOG_LEVEL/);
   });
+
+  it("throws when CORS_ORIGIN contains wildcard", () => {
+    process.env.CORS_ORIGIN = "*";
+    expect(() => require("../src/config/env")).toThrow(/wildcard/i);
+  });
 });