[BE-129] Harden CORS configuration

[mftee]

Overview

main.ts configures CORS as:

origin: configService.get<string>('FRONTEND_URL') || 'http://localhost:3001',
credentials: true,

With credentials: true, the allowed origin must be exact and trustworthy. The fallback to a localhost origin means a misconfigured deployment where FRONTEND_URL is unset silently permits credentialed requests from a development origin instead of failing loudly.

Tasks

• Require FRONTEND_URL explicitly in production — fail startup rather than falling back to localhost ([BE-113] provides the validation mechanism).
• Support multiple allowed origins via a comma-separated list, validated against an allowlist rather than reflected.
• Never reflect an arbitrary Origin header back while credentials: true is set.
• Restrict allowed methods and headers to what the frontend actually uses.
• Add tests asserting a disallowed origin is rejected.

Acceptance Criteria

• Production refuses to start without an explicit frontend origin.
• A disallowed origin receives no CORS approval (covered by a test).
• The localhost fallback applies only in development.

Dependencies

Pairs with [BE-113].

Notes for Contributors

Comment below to be assigned.

[veemakama]

@veemakama has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

Hi, i would love to work on this

ℹ️ Repo Maintainers: To accept this application, review their application or assign @veemakama to this issue.

[AbuJulaybeeb]

@AbuJulaybeeb has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

hi maintainer, i am a Full-Stack and web3 Developer, with 4+ years of experience. I have carefully read and understand the description of this issue, and i would like to take on this issue

ℹ️ Repo Maintainers: To accept this application, review their application or assign @AbuJulaybeeb to this issue.

[Mkalbani]

@Mkalbani has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

Hi maintainers, can I work on this. I've worked on a similar work. Thank you.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Mkalbani to this issue.

[SMOGZ6783]

@SMOGZ6783 has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

please assign to me

ℹ️ Repo Maintainers: To accept this application, review their application or assign @SMOGZ6783 to this issue.

[drips-wave]

Congratulations, @Mkalbani! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on July 30, 2026.

🧑‍💻 @Mkalbani: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊

[drips-wave]

This issue has been completed by @Mkalbani as part of the Stellar Wave Program's 7th Wave 🥳

😎 @Mkalbani: You earned 200 Points for completing this issue! After the current Wave ends, you'll be eligible for a percentage of the Wave's reward pool based on the percentage of total points you've earned. Learn more here. You can also Leave a review to share your experience working on this issue.

🧑‍💻 Repo maintainers: How'd the contributor do? Leave a review to share your experience working with them.