Centralize CORS configuration for Express and Socket.IO using .env

server/.env.example

@@ -4,6 +4,9 @@ MONGO_URI="your_mongo_connection_string"
 # Server
 PORT=5000
 
+# Cors
+ALLOWED_ORIGINS=http://localhost:5173,https://guessync.netlify.app
+
 # Spotify API
 SPOTIFY_CLIENT_ID="your_spotify_client_id"
 SPOTIFY_CLIENT_SECRET="your_spotify_client_secret"

server/config/cors.js

@@ -0,0 +1,28 @@
+import cors from 'cors';
+
+const allowedOrigins = process.env.ALLOWED_ORIGINS ?
+  process.env.ALLOWED_ORIGINS.split(',').map(origin => origin.trim()) :
+  [];
+
+// Express CORS middleware
+export const corsMiddleware = () =>
+  cors({
+    origin: function(origin, callback) {
+      if (!origin || allowedOrigins.includes(origin)) {
+        callback(null, true);
+      } else {
+        callback(new Error('Not allowed by CORS'));
+      }
+    },
+    methods: ['GET', 'POST', 'PUT', 'DELETE'],
+    credentials: true,
+  });
+
+// Socket.IO CORS config
+export const socketCorsConfig = {
+  origin: allowedOrigins,
+  methods: ['GET', 'POST'],
+  credentials: true,
+};
+
+export const getAllowedOrigins = () => allowedOrigins;

server/server.js

@@ -2,7 +2,6 @@ import express from 'express';
 import http from 'http';
 import { Server } from 'socket.io';
 import dotenv from 'dotenv';
-import cors from 'cors';
 import rateLimit from 'express-rate-limit';
 import connectDB from './config/db.js';
 import socketHandler from './sockets/socketHandler.js';
@@ -11,37 +10,25 @@ import roomRoutes from './routes/roomRoutes.js';
 import songRoutes from './routes/songRoutes.js';
 import userRoutes from './routes/userRoutes.js';
 import { scheduleRoomCleanup } from "./cronJobs/roomCleanup.js";
+import { corsMiddleware, socketCorsConfig } from './config/cors.js';
 
 dotenv.config();
 connectDB();
 
 const app = express();
 const server = http.createServer(app);
-const allowedOrigins = [
-  'http://localhost:5173',
-  'https://guessync.netlify.app'
-];
 const io = new Server(server, {
-  cors: {
-    origin: allowedOrigins,
-    methods: ['GET', 'POST'],
-    credentials: true
-  }
+  cors: socketCorsConfig
 });
-const corsOptions = {
-    origin: allowedOrigins,
-    methods: ['GET', 'POST', 'PUT', 'DELETE'],
-    credentials: true
-};
-app.use(cors(corsOptions));
+app.use(corsMiddleware());
 app.use(express.json());
 
 const apiLimiter = rateLimit({
-    windowMs: 1 * 60 * 1000,
-    max: 5,
-    message: { error: 'Too many requests, please try again in a minute.' },
-    standardHeaders: true,
-    legacyHeaders: false,
+  windowMs: 1 * 60 * 1000,
+  max: 5,
+  message: { error: 'Too many requests, please try again in a minute.' },
+  standardHeaders: true,
+  legacyHeaders: false,
 });
 
 app.use('/api/room/create', apiLimiter);