security: Restrict CORS Wildcard Origin with Configurable Host Filter #284

packages/trpc/server/app.ts

@@ -6,37 +6,40 @@ import { configs } from "./utils/configs";
 import { k8sApi } from "./utils/k8s";
 
 const app = express();
-app.use(cors({ origin: "*" }));
+app.use(
+  cors({
+    origin: configs.AllowedOrigins,
+    credentials: true,
+  }),
+);
 
 app.use(
-    "/api",
-    trpcExpress.createExpressMiddleware({
-        router: appRouter,
-        createContext: () => ({ session: null }),
-    }),
+  "/api",
+  trpcExpress.createExpressMiddleware({
+    router: appRouter,
+    createContext: () => ({ session: null }),
+  }),
 );
 
 const verifyVolcanoSetup = async () => {
-    try {
-        await k8sApi.listClusterCustomObject({
-            group: "batch.volcano.sh",
-            version: "v1alpha1",
-            plural: "jobs",
-        });
-        return true;
-    } catch (error) {
-        console.error("Volcano verification failed:", error);
-        return false;
-    }
+  try {
+    await k8sApi.listClusterCustomObject({
+      group: "batch.volcano.sh",
+      version: "v1alpha1",
+      plural: "jobs",
+    });
+    return true;
+  } catch (error) {
+    console.error("Volcano verification failed:", error);
+    return false;
+  }
 };
 
 export const server = app.listen(configs.Port, async () => {
-    const volcanoReady = await verifyVolcanoSetup();
-    if (volcanoReady) {
-        console.log(
-            `Server running on port ${configs.Port} with Volcano support`,
-        );
-    } else {
-        console.error("Server started but Volcano support is not available");
-    }
+  const volcanoReady = await verifyVolcanoSetup();
+  if (volcanoReady) {
+    console.log(`Server running on port ${configs.Port} with Volcano support`);
+  } else {
+    console.error("Server started but Volcano support is not available");
+  }
 });

packages/trpc/server/utils/configs.ts

@@ -1,13 +1,19 @@
 import { config as dotenvConfig } from "dotenv";
 
 export interface Configs {
-    Port: number;
-    Env: string;
+  Port: number;
+  Env: string;
+  AllowedOrigins: string[];
 }
 
 dotenvConfig({ path: "secrets.env" });
 
 export const configs: Configs = {
-    Port: parseInt(process.env.PORT || "3001"),
-    Env: process.env.NODE_ENV || "development",
+  Port: parseInt(process.env.PORT || "3001"),
+  Env: process.env.NODE_ENV || "development",
+  AllowedOrigins: process.env.ALLOWED_ORIGINS
+    ? process.env.ALLOWED_ORIGINS.split(",")
+        .map((o) => o.trim())
+        .filter(Boolean)
+    : ["http://localhost:3000", "http://localhost:5173"],
 };