Summary
Harden CORS configuration on the ZCore API for production — replace permissive cors() with an explicit allowlist of dapp and partner origins.
Problem
Server/src/app.ts uses:
This allows any origin to call the API from browsers — acceptable for local dev, risky in production. Malicious sites could trigger authenticated requests if combined with weak session models.
Proposed implementation
const ALLOWED_ORIGINS = (process.env.CORS_ORIGINS ?? 'http://localhost:3001')
.split(',')
.map((o) => o.trim());
app.use(cors({
origin: (origin, callback) => {
if (!origin || ALLOWED_ORIGINS.includes(origin)) {
callback(null, true);
} else {
callback(new Error('Not allowed by CORS'));
}
},
credentials: true,
}));Production defaults (document, set in Vercel):
CORS_ORIGINS=https://dapp-zcore.vercel.app,https://zcore-xi.vercel.app
Preflight: Ensure OPTIONS works for auth endpoints
Acceptance criteria
Related
Out of scope
- CORS for Swagger UI (same origin as API — OK)
- Vercel Firewall rules
Summary
Harden CORS configuration on the ZCore API for production — replace permissive
cors()with an explicit allowlist of dapp and partner origins.Problem
Server/src/app.tsuses:This allows any origin to call the API from browsers — acceptable for local dev, risky in production. Malicious sites could trigger authenticated requests if combined with weak session models.
Proposed implementation
Production defaults (document, set in Vercel):
Preflight: Ensure
OPTIONSworks for auth endpointsAcceptance criteria
localhost:3001CORS_ORIGINSdocumented inServer/.env.exampleandDocs/vercel-deploy.mdRelated
Out of scope