Function createCORSMiddleware

cmd/dash.go:237–273

createCORSMiddleware creates middleware that handles CORS policies

(corsManager *CORSManager)

// createCORSMiddleware creates middleware that handles CORS policies
func createCORSMiddleware(corsManager *CORSManager) func(http.Handler) http.Handler {
	return func(next http.Handler) http.Handler {
		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
			origin := r.Header.Get("Origin")

			// Handle preflight requests (OPTIONS method)
			if r.Method == "OPTIONS" {
				// Set secure CORS headers for preflight
				w.Header().Set("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS")
				w.Header().Set("Access-Control-Allow-Headers", "Content-Type, Authorization, X-CSRF-Token")
				w.Header().Set("Access-Control-Allow-Credentials", "false") // Secure default
				w.Header().Set("Access-Control-Max-Age", "3600")            // Cache preflight for 1 hour

				// Only set Access-Control-Allow-Origin if origin is allowed
				if origin != "" && corsManager.IsOriginAllowed(origin) {
					w.Header().Set("Access-Control-Allow-Origin", origin)
				}

				w.WriteHeader(http.StatusNoContent)
				return
			}

			// For non-preflight requests, set CORS headers if origin is allowed
			if origin != "" && corsManager.IsOriginAllowed(origin) {
				w.Header().Set("Access-Control-Allow-Origin", origin)
				w.Header().Set("Access-Control-Allow-Credentials", "false") // Secure default
			}

			// Add security headers
			w.Header().Set("X-Content-Type-Options", "nosniff")
			w.Header().Set("X-Frame-Options", "DENY")
			w.Header().Set("X-XSS-Protection", "1; mode=block")

			next.ServeHTTP(w, r)
		})
	}
}

// Global CORS manager instance
var corsManager = NewCORSManager()