Merge pull request #536 from LeChatErrant/cors

Add CORS middleware

.envrc

@@ -2,6 +2,8 @@ export SESSION_SECRET=keyboard_cat
 export PORT=8000
 export MODE=local
 
+export WHITELIST=http://localhost,https://front.lechaterrant.com
+
 export DEFAULT_ADMIN_EMAIL=admin@api-template.com
 export DEFAULT_ADMIN_PASSWORD=admin
 

package.json

@@ -47,6 +47,7 @@
     "class-transformer": "^0.5.1",
     "class-validator": "^0.13.1",
     "connect-redis": "^6.0.0",
+    "cors": "^2.8.5",
     "env-var": "^7.1.1",
     "express": "^4.17.1",
     "express-async-handler": "^1.2.0",
@@ -64,6 +65,7 @@
   "devDependencies": {
     "@types/bcrypt": "^5.0.0",
     "@types/connect-redis": "0.0.18",
+    "@types/cors": "^2.8.12",
     "@types/express": "^4.17.13",
     "@types/express-session": "^1.17.4",
     "@types/http-errors": "^1.8.1",

src/app.ts

@@ -1,10 +1,12 @@
 import express from 'express';
 import helmet from 'helmet';
+import cors from 'cors';
 
 /*  This import is only used for class-transformer side effects */
 import 'reflect-metadata';
 
 import router from './routes';
+import { config } from './appConfig';
 import session from './appSession';
 import requestLogger from './middlewares/requestLogger';
 import errorMiddleware from './middlewares/errorMiddleware';
@@ -21,6 +23,9 @@ app.use(session);
 app.use(express.json());
 app.use(express.urlencoded({ extended: false }));
 app.use(helmet());
+app.use(cors({
+  origin: config.whitelist,
+}));
 app.use(meMiddleware);
 app.use(requestLogger);
 

src/appConfig.ts

@@ -11,6 +11,7 @@ export enum MODES {
 
 export const config = {
   port: env('PORT').asPortNumber(),
+  whitelist: env('WHITELIST').asArray(','),
   sessionSecret: env('SESSION_SECRET').asString(),
   mode: env('MODE').asEnum(Object.values(MODES)),
   defaultAdminEmail: env('DEFAULT_ADMIN_EMAIL').asString(),