Fix CORS Implementation in MythAPI

[Copilot]

Overview

This PR implements a proper Cross-Origin Resource Sharing (CORS) policy in the MythAPI application to address the identified security issue.

Changes Made

• Added CORS service registration in Program.cs
• Implemented two different CORS policies:
  • A restrictive policy for production environments with specific allowed origins, methods, and headers
  • A permissive policy for development environments to facilitate testing
• Added middleware configuration to apply the appropriate CORS policy based on the current environment

Implementation Details

// Production CORS policy
options.AddPolicy("ApiCorsPolicy", builder =>
{
    builder
        .WithOrigins(
            "https://trusted-domain.com",
            "https://another-trusted-domain.com"
        )
        .WithMethods("GET", "POST")
        .WithHeaders("Authorization", "Content-Type")
        .AllowCredentials();
});

// Development CORS policy
options.AddPolicy("Development", builder =>
{
    builder
        .AllowAnyOrigin()
        .AllowAnyMethod()
        .AllowAnyHeader();
});

The CORS middleware is applied before registering endpoints but after building the application:

if (app.Environment.IsDevelopment())
{
    app.UseCors("Development");
}
else
{
    app.UseCors("ApiCorsPolicy");
}

Notes

• No additional NuGet packages were required as CORS middleware is included in ASP.NET Core
• For production use, the allowed origins should be updated to match actual trusted domains
• All existing tests continue to pass after these changes

Fixes #2.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[aatmmr]

LGTM