Add domain whitelist

app.js

@@ -44,7 +44,17 @@ if( config.USE_RATE_LIMITER) {
 app.use(bodyParser.json());
 app.use(bodyParser.urlencoded({ extended: false }));
 app.use(cookieParser());
-app.use(cors());
+app.use(cors({
+  origin: (origin, callback) => {
+    if(config.ALLOWED_DOMAINS.includes(origin) || config.ALLOWED_DOMAINS.includes('*')) {
+      callback(null, true);
+    } else {
+      let error = new Error('Not allowed by CORS');
+      error.status = 403;
+      callback(error);
+    }
+  }
+}));
 app.use(helmet());
 app.use(helmet.hsts({
   maxAge: config.HSTS_MAX_AGE,
@@ -88,12 +98,13 @@ app.use(function(req, res, next) {
 });
 
 app.use(function(err, req, res, next) {
-  res.status(err.status || 500);
   logger.error({req: req, res: res, err: err});
-  res.json({
-    message: err.message,
-    error: app.get('env') === 'development' ? err : {}
-  });
+  res
+    .status(err.status || 500)
+    .json({
+      message: err.message,
+      error: app.get('env') === 'development' ? err : {}
+    });
 });
 
 /* ------------------------------------------------------------------ *

config/index.js

@@ -77,19 +77,20 @@ function getSwaggerConf(isProd, apiUrl) {
  */
 function getConfig(env='development') {
   let config = {
-    prod_envs: ['prod', 'production', 'stag', 'staging']
+    prod_envs: ['prod', 'production']
   };
 
-  const isProd = config.prod_envs.includes(env);
   const cloudFoundryEnv = cfenv.getAppEnv();
 
+  config.isProd = config.prod_envs.includes(env);
+
   if(cloudFoundryEnv.isLocal) {
     dotenv.config(path.join(path.dirname(__dirname), '.env'));
   }
 
   config.LOGGER_LEVEL = process.env.LOGGER_LEVEL
     ? process.env.LOGGER_LEVEL
-    : isProd
+    : config.isProd
       ? 'INFO'
       : 'DEBUG';
 
@@ -111,7 +112,7 @@ function getConfig(env='development') {
     '2.0.0'
   ];
 
-  config.USE_HSTS = process.env.USE_HSTS ? process.env.USE_HSTS === 'true' : isProd;
+  config.USE_HSTS = process.env.USE_HSTS ? process.env.USE_HSTS === 'true' : config.isProd;
   config.HSTS_MAX_AGE = process.env.HSTS_MAX_AGE ? parseInt(process.env.HSTS_MAX_AGE) : 31536000;
   config.HSTS_PRELOAD = false;
   config.PORT = getPort(cloudFoundryEnv);
@@ -124,8 +125,9 @@ function getConfig(env='development') {
     : cloudFoundryEnv.app.uris
       ? `${cloudFoundryEnv.app.uris[0]}/api`
       : `0.0.0.0:${config.PORT}`;
-  config.SWAGGER_DOCUMENT = getSwaggerConf(isProd, apiUrl);
+  config.SWAGGER_DOCUMENT = getSwaggerConf(config.isProd, apiUrl);
 
+  config.ALLOWED_DOMAINS = config.isProd ? ['https://api.data.gov'] : ['*'];
   return config;
 }
 

services/indexer/repo/AgencyJsonStream.js

@@ -55,7 +55,7 @@ class AgencyJsonStream extends Transform {
   async _getAgencyCodeJson(agency){
     logger.info('Entered _getAgencyCodeJson - Agency: ', agency.acronym);
 
-    if(this.config.prod_envs.includes(process.env.NODE_ENV)) {
+    if(this.config.isProd) {
       const errorMessage = 'FAILURE: There was an error fetching the code.json:';
       let response;
 

test/unit/services/indexer/repo/agencyJsonStream.test.js

@@ -24,7 +24,7 @@ describe('AgencyJsonStream', function() {
     fetchDataDir = path.join(testDataDir, '/fetched');
     agency = JsonFile.readFileSync(path.join(testDataDir, 'test_agency_metadata.json'));
     agencyJsonStream = new AgencyJsonStream(fetchDataDir, fallbackDataDir, {
-      prod_envs: ['prod', 'production', 'stag', 'staging'],
+      isProd: false,
       supportedSchemaVersions: [
         '1.0.0',
         '1.0.1',