CORS Project — Build a Full-Stack Application with Secure Cross-Origin Configuration

// Frontend: React with CORS-aware fetch
const API_BASE = process.env.REACT_APP_API_URL;

async function apiRequest(endpoint, options = {}) {
  const response = await fetch(`${API_BASE}${endpoint}`, {
    ...options,
    credentials: 'include',
    headers: {
      'Content-Type': 'application/json',
      ...options.headers,
    },
  });

  if (!response.ok) {
    const error = await response.json().catch(() => ({}));
    throw new Error(error.message || 'API Error');
  }

  return response.json();
}

// Login
await apiRequest('/auth/login', {
  method: 'POST',
  body: JSON.stringify({ email, password }),
});

// Get user data (session cookie sent automatically)
const userData = await apiRequest('/user/profile');

// Backend: Express with production CORS
const express = require('express');
const cors = require('cors');
const session = require('express-session');

const app = express();

// Dynamic origin whitelist
const ALLOWED_ORIGINS = [
  'http://localhost:3000',                    // Development
  'https://dashboard.dodatech.com',           // Production
  'https://staging.dodatech.com',             // Staging
];

app.use(cors({
  origin: function (origin, callback) {
    // Allow requests with no origin (server-to-server)
    if (!origin) return callback(null, true);
    if (ALLOWED_ORIGINS.includes(origin)) {
      callback(null, origin);
    } else {
      callback(new Error(`Origin ${origin} not allowed`));
    }
  },
  credentials: true,
  methods: ['GET', 'POST', 'PUT', 'DELETE'],
  allowedHeaders: ['Content-Type', 'Authorization'],
  exposedHeaders: ['X-Request-ID'],
  maxAge: 86400,
}));

// Session configuration for cross-origin
app.use(session({
  name: 'sessionId',
  secret: process.env.SESSION_SECRET,
  resave: false,
  saveUninitialized: false,
  cookie: {
    httpOnly: true,
    secure: true,
    sameSite: 'none',    // Required for cross-origin
    maxAge: 24 * 60 * 60 * 1000,
  },
}));

# Automated CORS tests for CI/CD
import requests
import pytest

BASE_URL = "https://staging.dodatech.com/api"
ALLOWED_ORIGIN = "https://staging.dodatech.com"
BLOCKED_ORIGIN = "https://evil.com"


class TestCORSProduction:
    def test_allowed_origin_has_acao(self):
        r = requests.get(f"{BASE_URL}/health",
                         headers={"Origin": ALLOWED_ORIGIN})
        assert r.headers.get("Access-Control-Allow-Origin") == ALLOWED_ORIGIN

    def test_blocked_origin_rejected(self):
        r = requests.get(f"{BASE_URL}/health",
                         headers={"Origin": BLOCKED_ORIGIN})
        acao = r.headers.get("Access-Control-Allow-Origin")
        assert acao is None or acao == "null"

    def test_credentials_allowed_with_specific_origin(self):
        r = requests.get(f"{BASE_URL}/user/profile",
                         headers={"Origin": ALLOWED_ORIGIN},
                         cookies={"sessionId": "test"})
        assert r.headers.get("Access-Control-Allow-Credentials") == "true"

    def test_preflight_allows_delete(self):
        r = requests.options(f"{BASE_URL}/user/1",
                             headers={
                                 "Origin": ALLOWED_ORIGIN,
                                 "Access-Control-Request-Method": "DELETE",
                             })
        methods = r.headers.get("Access-Control-Allow-Methods", "")
        assert "DELETE" in methods

# Deploy with CORS validation
npm run build
npm test  # Includes CORS tests
npx netlify-cli deploy --dir=build --prod