Refactor CORS configuration to use dynamic origin handling and add origin utility

app.js

@@ -6,12 +6,13 @@ const cors = require('cors')
 const csrf = require('./middleware/csrf')
 const response = require('./utils/responseHandler')
 const app = express()
+const {origin} = require('./utils/origin')
 
 require('./config/db')()
 
 app.use(logger('dev'))
 app.use(express.json())
-app.use(cors({ origin: 'https://dev-sidali.kemdiktisaintek.go.id', credentials: true }))
+app.use(cors({ origin: origin(['https://dev-sidali.kemdiktisaintek.go.id']), credentials: true }))
 app.use(express.urlencoded({ extended: false }))
 app.use(cookieParser(process.env.SRU51))
 // app.use(csrf( ['GET', 'HEAD', 'OPTIONS'], ['/v1/auth/login', /\/v1\/auto\//i, /v2/i]))

utils/origin.js

@@ -0,0 +1,16 @@
+exports.origin = (whitelist) => (origin, callback) => {
+  // Allow requests with no origin (mobile apps, postman, curl)
+  if (!origin) return callback(null, true)
+
+  // Allow exact domain
+  if (whitelist.includes(origin)) {
+    return callback(null, true)
+  }
+
+  // Allow localhost with any port
+  if (origin.startsWith('http://localhost')) {
+    return callback(null, true)
+  }
+
+  return callback(new Error('Not allowed by CORS'))
+}