feat: add CORS configuration

README.md

@@ -136,6 +136,9 @@ file and load that either using the `--config` CLI parameter or using environmen
  - `RIFM_PORT` (number): port on which the server should listen to
  - `RIFM_DB` (string): database connection URI
  - `RIFM_PROVIDER` (string): blockchain connection URI
+ - CORS settings ([see more on expressjs documentation](https://expressjs.com/en/resources/middleware/cors.html)):
+    - `RIFM_CORS_ORIGIN` (boolean | string | regexp): Configures the Access-Control-Allow-Origin CORS header
+    - `RIFM_CORS_METHODS` (string) Configures the Access-Control-Allow-Methods CORS header
  - Storage related:
     - `RIFM_STORAGE_CONTRACT_ADDR` (string): address of deployed storage contract
     - `RIFM_STORAGE_STARTING_BLOCK` (number | string): block from which the caching service should process events

config/custom-environment-variables.json5

@@ -2,6 +2,11 @@
   port: 'RIFM_PORT',
   db: 'RIFM_DB',
 
+  cors: {
+    origin: "RIFM_CORS_ORIGIN",
+    methods: "RIFM_CORS_METHODS"
+  },
+
   blockchain: {
     provider: "RIFM_PROVIDER",
   },

config/default.json5

@@ -4,6 +4,12 @@
   port: null,
   db: 'sqlite:db.sqlite',
 
+  // CORS setting, please consult https://expressjs.com/en/resources/middleware/cors.html for more details
+  cors: {
+    origin: '*',
+    methods: 'GET,HEAD'
+  },
+
   log: {
     level: "info",
     filter: null,

src/app.ts

@@ -1,6 +1,7 @@
 import compress from 'compression'
 import helmet from 'helmet'
-import cors from 'cors'
+import cors, { CorsOptionsDelegate } from 'cors'
+import config from 'config'
 
 import feathers from '@feathersjs/feathers'
 import express from '@feathersjs/express'
@@ -37,9 +38,11 @@ export function isSupportedServices (value: any): value is SupportedServices {
 export function appFactory (): Application {
   const app: Application = express(feathers())
 
+  const corsOptions: CorsOptionsDelegate = config.get('cors')
+
   // Enable security, CORS, compression and body parsing
   app.use(helmet())
-  app.use(cors())
+  app.use(cors(corsOptions))
   app.use(compress())
   app.use(express.json())
   app.use(express.urlencoded({ extended: true }))