feat: cors policy added

hepsiburada · Nov 11, 2024 · b00e710 · b00e710
1 parent d631a88
commit b00e710
Showing 1 changed file with 8 additions and 1 deletion.
diff --git a/src/server.js b/src/server.js
@@ -105,7 +105,14 @@ const handleUrls = async (req, res, next) => {
 };
 
 const cors = async (req, res, next) => {
-  res.setHeader('Access-Control-Allow-Origin', req.header('Origin'));
+  const { corsWhiteListDomains } = voltranConfig;
+  const { origin } = req.headers;
+  if (origin && corsWhiteListDomains?.map(domain => domain?.includes(origin))) {
+    res.setHeader('Access-Control-Allow-Origin', origin);
+    res.setHeader('Access-Control-Allow-Credentials', 'true');
+  } else {
+    res.setHeader('Access-Control-Allow-Origin', '*');
+  }
   res.setHeader('Access-Control-Allow-Methods', 'GET, PUT, POST, DELETE, HEAD, OPTIONS');
 
   if (req.method === 'OPTIONS') {