Update CORS configuration in config.json and README.md to allow multiple origins. Refactor CORS handling in index.js to utilize new server.corsOrigins setting, enhancing API security and flexibility.

README.md

@@ -155,7 +155,7 @@ The application uses Keycloak for authentication. Configure your Keycloak server
 The application uses MongoDB. Ensure your MongoDB instance is running and accessible at the configured `DB_LINK`.
 
 ### CORS Configuration
-The application is configured to allow requests only from the specified `APP_URL_CLIENT`. Update this in your environment configuration.
+Allowed request origins are configured via `server.corsOrigins` in `config.json`. When omitted, the API falls back to `app.urlClient` and `app.urlElectronClient`.
 
 ## 🚀 Deployment
 

config.json

@@ -2,7 +2,14 @@
   "development": {
     "server": {
       "port": 8787,
-      "logLevel": "trace"
+      "logLevel": "trace",
+      "corsOrigins": [
+        "https://web.farmcontrol.app",
+        "https://dev.tombutcher.work",
+        "http://localhost:5173",
+        "http://localhost:3000",
+        "http://localhost:5780"
+      ]
     },
     "auth": {
       "enabled": true,
@@ -124,7 +131,8 @@
   "production": {
     "server": {
       "port": 8080,
-      "logLevel": "info"
+      "logLevel": "info",
+      "corsOrigins": ["https://web.farmcontrol.app", "views://mainview"]
     },
     "auth": {
       "enabled": true,

src/index.js

@@ -81,14 +81,15 @@ logger.level = config.server.logLevel;
 
 app.use(log4js.connectLogger(logger, { level: 'trace' }));
 
-const whitelist = [config.app.urlClient, config.app.urlElectronClient];
+const allowedOrigins =
+  config.server.corsOrigins ||
+  [config.app.urlClient, config.app.urlElectronClient].filter(Boolean);
 const corsOptions = {
   origin: function (origin, callback) {
-    if (!origin || whitelist.indexOf(origin) !== -1) {
-      callback(null, true);
-    } else {
+    if (!origin) return callback(null, true);
+    if (allowedOrigins.includes('*')) return callback(null, true);
+    if (allowedOrigins.includes(origin)) return callback(null, true);
     callback(new Error('Not allowed by CORS'));
-    }
   },
   credentials: true,
 };