From fb05c49b0734d84af53a267e67fc4ff6768fc7b2 Mon Sep 17 00:00:00 2001 From: John O'Keefe Date: Fri, 6 Mar 2026 14:15:07 -0500 Subject: [PATCH] feat(server): configure CORS with explicit security settings Replace default CORS middleware with explicit configuration to properly control cross-origin access. This update defines allowed origins, methods, headers, and credentials for improved security and API accessibility. Configuration changes: - Allow all origins (*) for development flexibility - Support standard HTTP methods (GET, POST, PUT, DELETE, OPTIONS) - Expose Content-Length header for response inspection - Disable credentials to simplify authentication flow --- cmd/server/main.go | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/cmd/server/main.go b/cmd/server/main.go index c7f07a3..3bfa36c 100644 --- a/cmd/server/main.go +++ b/cmd/server/main.go @@ -140,7 +140,13 @@ func main() { // Middleware e.Use(echomiddleware.RequestLogger()) e.Use(echomiddleware.Recover()) - e.Use(echomiddleware.CORS()) + e.Use(echomiddleware.CORSWithConfig(echomiddleware.CORSConfig{ + AllowOrigins: []string{"*"}, + AllowMethods: []string{"GET", "POST", "PUT", "DELETE", "OPTIONS"}, + AllowHeaders: []string{"Origin", "Content-Type", "Authorization"}, + ExposeHeaders: []string{"Content-Length"}, + AllowCredentials: false, + })) e.Use(ratelimit.RequestTracingMiddleware(cfg)) // Rate limiter for auth endpoints