No CORS origin validation error message

[ritaifeoluwa]

What changed

• src/middleware/cors.js rejects requests from unauthorized origins
• The error response doesn't explain why the request was blocked

Why

• Developers debugging CORS issues need to know their origin isn't in the allowed list
• Should return a clear error message with the rejected origin

How to test

1. Make a request from an unauthorized origin
2. Check the error response — generic 403, no mention of CORS

[Smartdevs17]

@Smartdevs17 has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

can I work on this?

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Smartdevs17 to this issue.

[Eltimios]

@Eltimios has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

I'd like to work on this issue. My approach:

1. Locate the rejection path: in src/middleware/cors.js, find where the origin check runs (likely comparing req.headers.origin against an allowed-origins list/config) and where it currently short-circuits to a generic 403 without including any details.

2. Structured error response: on rejection, return a JSON error body (not just a bare 403) that includes an error code (e.g. "cors_origin_not_allowed"), a human-readable message, and the specific rejected origin value that was received — so a developer debugging a blocked request can immediately see what was sent and why it didn't match.

3. Avoid leaking the full allow-list: I won't echo the complete list of allowed origins back in the response (that's an unnecessary info disclosure) — just confirm the request's own origin was rejected, matching how most CORS-debugging tooling behaves.

4. Preserve existing behavior otherwise: keep the 403 status code and the actual CORS-blocking behavior unchanged — this is purely about making the error body informative, not changing what gets allowed/blocked.

5. Logging: optionally add a debug-level log line on rejection including the origin, so server-side logs also show the same information for cases where the client can't see the response body.

6. Tests: add/extend middleware tests asserting that a request from an unauthorized origin returns a 403 with a JSON body containing the rejected origin and a clear message, and that requests from allowed origins are unaffected.

Relevant experience: I've worked with Express/Node CORS middleware before and written targeted, backward-compatible error-message improvements without touching the underlying authorization logic — this is a small, well-scoped fix I can turn around quickly.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Eltimios to this issue.

[drips-wave]

Congratulations, @Smartdevs17! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on August 31, 2026.

🧑‍💻 @Smartdevs17: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊

[grantfox-oss]

🎉 This issue has been marked as completed on GrantFox as part of the Third Campaign campaign!

@Smartdevs17's PR #267 was approved and merged by @ritaifeoluwa.

🏆 @Smartdevs17: You earned 35 FoxPoints for this contribution! Your current tier: Explorer (987 total points). Track your full progress on GrantFox.

👏 Great work, @Smartdevs17! Keep contributing to SmartDropLabs.

[drips-wave]

This issue has been completed by @Smartdevs17 as part of the Stellar Wave Program's 8th Wave 🥳

😎 @Smartdevs17: You earned 200 Points for completing this issue! After the current Wave ends, you'll be eligible for a percentage of the Wave's reward pool based on the percentage of total points you've earned. Learn more here. You can also Leave a review to share your experience working on this issue.

🧑‍💻 Repo maintainers: How'd the contributor do? Leave a review to share your experience working with them.