Tighten CORS headers in nginx for production

[Lucasmind]

Priority: MEDIUM

Problem

The nginx configuration uses Access-Control-Allow-Origin: *, which allows any origin to make requests to the API endpoints. While fine for local development, this is a security risk if the service is exposed on a network.

Current Config

add_header Access-Control-Allow-Origin * always;

Suggested Fix

Restrict to the frontend origin:

# Development
add_header Access-Control-Allow-Origin "http://localhost:3000" always;

# Or use a variable for flexibility
map $http_origin $cors_origin {
    default "";
    "http://localhost:3000" "$http_origin";
    "https://yourdomain.com" "$http_origin";
}
add_header Access-Control-Allow-Origin $cors_origin always;

Files Affected

• frontend/nginx.conf