[backend][security] CORS allowlist is commented out

[Xhristin3]

Severity

High

Files

app/backend/src/main.ts (app.enableCors block)

Description

No CORS is configured. In dev the frontend at http://localhost:3000 is allowlisted by browser policy but in production this becomes vacuous. Currently any origin can connect.

Acceptance Criteria

• Configure CORS via env ALLOWED_ORIGINS (comma-separated)
• credentials: true only when origin allowlisted
• methods limited to GET/POST/PUT/PATCH/DELETE/OPTIONS
• Add a contract test that asserts disallowed preflight returns no Access-Control-Allow-Origin

[YfengJ]

Hi maintainers, I would like to apply for this issue if it is available.

If assigned, I would keep the CORS hardening narrow: read ALLOWED_ORIGINS from ConfigService, enable credentials only for allowlisted origins, restrict methods to the requested set, preserve local development behavior explicitly, and add a contract/e2e preflight test proving disallowed origins do not receive Access-Control-Allow-Origin.

I will wait for assignment or explicit maintainer/GrantFox confirmation before cloning, implementing, or opening a PR.

[clintjeff2]

Hello, I have 6 years of experience working on tasks like this and handling similar challenges across backend, frontend, and smart-contract development. I have carefully read and fully understood the task requirements, and I am confident I can deliver a clean, efficient, and well-tested solution promptly. I always ensure high-quality implementation, maintainability, and adherence to best practices.

Pull request in 5 hours.

[Xuccessor]

can I take this?