feat: make CORS headers configurable (#529)

BoltzExchange · Apr 21, 2024 · efc463f · efc463f
1 parent c3f6aaa
commit efc463f
Show file tree

Hide file tree

Showing 3 changed files with 18 additions and 1 deletion.
diff --git a/docs/deployment.md b/docs/deployment.md
@@ -65,6 +65,10 @@ prepayminerfee = false
 host = "127.0.0.1"
 port = 9_001
 
+# Configure CORS headers set by the backend
+# "" to disable
+cors = "*"
+
 # The backend can expose a metrics endpoint about swap count, volume, etc
 # [prometheus]
 # host = "127.0.0.1"

diff --git a/lib/Config.ts b/lib/Config.ts
@@ -111,6 +111,7 @@ type EthereumConfig = RskConfig & {
 type ApiConfig = {
   host: string;
   port: number;
+  cors?: string | string[];
 };
 
 type GrpcConfig = {
@@ -244,6 +245,7 @@ class Config {
       api: {
         host: '127.0.0.1',
         port: 9001,
+        cors: '*',
       },
 
       grpc: {

diff --git a/lib/api/Api.ts b/lib/api/Api.ts
@@ -22,7 +22,18 @@ class Api {
   ) {
     this.app = express();
     this.app.set('trust proxy', 'loopback');
-    this.app.use(cors());
+
+    if (config.cors === undefined || config.cors.length !== 0) {
+      this.app.use(
+        cors({
+          origin: config.cors || '*',
+          methods: 'GET,HEAD,PUT,PATCH,POST,DELETE',
+          preflightContinue: false,
+          optionsSuccessStatus: 204,
+        }),
+      );
+    }
+
     this.app.use(
       express.json({
         verify(req, _, buf: Buffer, encoding: string) {