[story-1155] - Cross Origin Resource Sharing (CORS) Misconfiguration

src/.env.sample

@@ -164,3 +164,6 @@ EVENT_ORG_LISTENER_URLS='http://interface:3567/mentoring/v1/organization/eventLi
 EVENT_ENABLE_ORG_EVENTS=true
 #Generic Email template for new users
 GENERIC_INVITATION_EMAIL_TEMPLATE_CODE=generic_invite
+
+# Allowed host by CORS
+ALLOWED_HOST = "http://examplDomain.com"

src/app.js

@@ -65,6 +65,12 @@ app.use(bodyParser.json({ limit: '50MB' }))
 
 app.use(express.static('public'))
 
+// Middleware to set Access-Control-Allow-Origin header
+app.use((req, res, next) => {
+	res.setHeader('Access-Control-Allow-Origin', process.env.ALLOWED_HOST)
+	next()
+})
+
 /* Logs request info if environment is configured to enable log */
 app.all('*', (req, res, next) => {
 	logger.info('***User Service Request Log***', {

src/envVariables.js

@@ -232,6 +232,11 @@ let enviromentVariables = {
 		optional: true,
 		default: 'generic_invite',
 	},
+	ALLOWED_HOST: {
+		message: 'Required CORS allowed host',
+		optional: true,
+		default: '*',
+	},
 }
 
 let success = true