Repository navigation
config: CORS_ORIGIN accepts only one origin and defaults to localhost in production #2
Description
Problem
src/config/env.ts declares:
CORS_ORIGIN: z.string().default("http://localhost:3000"),Two problems. It is a single string, so the API cannot serve a preview
deployment and production at once. And the default is a development origin that
silently applies in production if the variable is unset — a misconfiguration
that fails open rather than closed.
What to do
- Accept a comma-separated list, parsed into an array.
- Require the variable explicitly when
NODE_ENV === "production"— no default. - Reject
*in production outright. - Configure
@fastify/corswithcredentialsand allowed methods stated
deliberately rather than left implicit.
Acceptance criteria
- Multiple origins supported
- Production requires an explicit value; startup fails without one
- Wildcard rejected in production
- Tests cover parsing and the production guard
Notes
Fail closed. A CORS default that works in development and quietly persists into
production is the standard way this becomes a real vulnerability.
Activity
telemarkdigital-publisher commentedon Aug 19, 2026
I can take this. Plan: replace single-origin CORS parsing with a validated allowlist, fail unsafe production defaults clearly, and add tests for multiple origins plus production misconfiguration. Expected verification: npm test or the repo's config/CORS test target once dependencies are available.
joelpeace48-cell commentedon Aug 24, 2026
@telemarkdigital-publisher, please don't spam this repo
Codeinx commentedon Aug 25, 2026
Hi Maintainer,
I’ve followed Lingualayer for a while and contributed in the last wave.
This issue is right up my alley and I’d love to contribute to something I use and believe in.
If it’s still available, please assign it to me. ETA 7hrs
joelpeace48-cell commentedon Aug 25, 2026
@Codeinx, ensure all ci pipeline passes..... you are assigned
grantfox-oss commentedon Aug 25, 2026
🦊 GrantFox — @Codeinx has been assigned to this issue as part of the Third Campaign campaign!
Next steps:
Closes #2)Good luck! Track your progress on GrantFox.
grantfox-oss commentedon Aug 25, 2026
🎉 This issue has been marked as completed on GrantFox as part of the Third Campaign campaign!
@Codeinx's PR #73 was approved and merged by @joelpeace48-cell.
🏆 @Codeinx: You earned 35 FoxPoints for this contribution! Your current tier: Explorer (153 total points). Track your full progress on GrantFox.
👏 Great work, @Codeinx! Keep contributing to FinesseStudioLab.