Implement secure CORS configuration system

api/rest/router.go

@@ -2,6 +2,8 @@ package rest
 
 import (
 	"net/http"
+	"strconv"
+	"strings"
 
 	"github.com/gorilla/mux"
 	"github.com/igodwin/notifier/internal/auth"
@@ -9,13 +11,45 @@ import (
 	"github.com/igodwin/notifier/internal/logging"
 )
 
-// NewRouter creates a new HTTP router with all routes configured
-func NewRouter(service domain.NotificationService, logger *logging.Logger) *mux.Router {
-	return NewRouterWithAuth(service, logger, nil)
+// CORSConfig contains CORS middleware configuration
+type CORSConfig struct {
+	// AllowedOrigins is a whitelist of allowed origins (e.g., ["https://example.com", "https://app.example.com"])
+	// Wildcards are NOT supported for security reasons
+	AllowedOrigins []string
+
+	// AllowedMethods is a list of allowed HTTP methods (e.g., ["GET", "POST", "OPTIONS", "DELETE"])
+	AllowedMethods []string
+
+	// AllowedHeaders is a list of allowed HTTP headers (e.g., ["Content-Type", "Authorization"])
+	AllowedHeaders []string
+
+	// AllowCredentials indicates whether credentials (cookies, authorization headers) are allowed
+	// Note: When true, AllowedOrigins must NOT contain wildcards
+	AllowCredentials bool
+
+	// MaxAge is the duration in seconds that browsers can cache preflight responses
+	MaxAge int
 }
 
-// NewRouterWithAuth creates a new HTTP router with optional authentication
-func NewRouterWithAuth(service domain.NotificationService, logger *logging.Logger, authStore *auth.APIKeyStore) *mux.Router {
+// DefaultCORSConfig returns a secure default CORS configuration
+// By default, no origins are allowed - you must explicitly configure allowed origins
+func DefaultCORSConfig() *CORSConfig {
+	return &CORSConfig{
+		AllowedOrigins:   []string{}, // Empty by default - must be explicitly configured
+		AllowedMethods:   []string{"GET", "POST", "OPTIONS", "DELETE"},
+		AllowedHeaders:   []string{"Content-Type", "Authorization"},
+		AllowCredentials: false,
+		MaxAge:           3600, // 1 hour
+	}
+}
+
+// NewRouter creates a new HTTP router with all routes configured
+func NewRouter(service domain.NotificationService, logger *logging.Logger) *mux.Router {
+	return NewRouterWithAuth(service, logger, nil, DefaultCORSConfig())
+}
+
+// NewRouterWithAuth creates a new HTTP router with optional authentication and CORS configuration
+func NewRouterWithAuth(service domain.NotificationService, logger *logging.Logger, authStore *auth.APIKeyStore, corsConfig *CORSConfig) *mux.Router {
 	handler := NewHandler(service, logger)
 	router := mux.NewRouter()
 
@@ -45,9 +79,11 @@ func NewRouterWithAuth(service domain.NotificationService, logger *logging.Logge
 	// Health check route (no auth required)
 	router.HandleFunc("/health", handler.HealthCheck).Methods(http.MethodGet)
 
-	// Middleware
+	// Middleware - CORS must be applied before auth to handle preflight requests
 	router.Use(loggingMiddleware)
-	router.Use(corsMiddleware)
+	if corsConfig != nil {
+		router.Use(newCORSMiddleware(corsConfig))
+	}
 
 	return router
 }
@@ -60,18 +96,55 @@ func loggingMiddleware(next http.Handler) http.Handler {
 	})
 }
 
-// corsMiddleware adds CORS headers
-func corsMiddleware(next http.Handler) http.Handler {
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Access-Control-Allow-Origin", "*")
-		w.Header().Set("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS")
-		w.Header().Set("Access-Control-Allow-Headers", "Content-Type, Authorization")
+// newCORSMiddleware creates a CORS middleware with origin whitelist validation
+func newCORSMiddleware(config *CORSConfig) func(http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			origin := r.Header.Get("Origin")
 
-		if r.Method == http.MethodOptions {
-			w.WriteHeader(http.StatusOK)
-			return
-		}
+			// Check if the origin is in the allowed list
+			allowed := false
+			for _, allowedOrigin := range config.AllowedOrigins {
+				if origin == allowedOrigin {
+					allowed = true
+					break
+				}
+			}
 
-		next.ServeHTTP(w, r)
-	})
+			// Only set CORS headers if the origin is allowed
+			if allowed {
+				// Set the exact origin (never use wildcard)
+				w.Header().Set("Access-Control-Allow-Origin", origin)
+
+				// Set allowed methods
+				if len(config.AllowedMethods) > 0 {
+					w.Header().Set("Access-Control-Allow-Methods", strings.Join(config.AllowedMethods, ", "))
+				}
+
+				// Set allowed headers
+				if len(config.AllowedHeaders) > 0 {
+					w.Header().Set("Access-Control-Allow-Headers", strings.Join(config.AllowedHeaders, ", "))
+				}
+
+				// Set credentials header if enabled
+				if config.AllowCredentials {
+					w.Header().Set("Access-Control-Allow-Credentials", "true")
+				}
+
+				// Set max age for preflight caching
+				if config.MaxAge > 0 {
+					w.Header().Set("Access-Control-Max-Age", strconv.FormatInt(int64(config.MaxAge), 10))
+				}
+			}
+
+			// Handle preflight OPTIONS requests
+			if r.Method == http.MethodOptions {
+				// Return 200 OK for preflight requests
+				w.WriteHeader(http.StatusOK)
+				return
+			}
+
+			next.ServeHTTP(w, r)
+		})
+	}
 }