🐛 Bug Report: Wildcard CORS Configuration Exposes Backend to Security Risks

[manurajgoel]

📜 Description

In server.js, CORS is configured with a wildcard '*', which allows any origin to make requests to the backend — including malicious websites.

// Current (vulnerable)
app.use(cors('*'));

This is a serious security risk for an authenticated app that uses express-session and passport. With wildcard CORS:

• Credentials/cookies may be exposed to untrusted origins
• Any third-party site can make API calls to the backend
• Session hijacking attacks become easier

Expected Behavior:
CORS should only allow requests from the known frontend origin (e.g., http://localhost:5173 in dev, and the deployed frontend URL in production), configured via an environment variable.

Suggested Fix:

// After fix in server.js
app.use(cors({
  origin: process.env.ALLOWED_ORIGIN || 'http://localhost:5173',
  credentials: true
}));

What browsers are you seeing the problem on?

No response

📃 Relevant Screenshots (Links)

No response