Fix security issues

app.ts

@@ -18,8 +18,8 @@ let cors = require('cors');
 dotenv.config();
 
 if (!process.env.PORT) {
-    logger.error('No port');
-    process.exit(1);
+	logger.error('No port');
+	process.exit(1);
 }
 
 const port: number = parseInt(process.env.PORT, 10);
@@ -30,40 +30,57 @@ const server: http.Server = http.createServer(app);
 // here we are adding middleware to parse all incoming requests as JSON
 app.use(express.json());
 
-// Use CORS
-app.use(cors());
+// Configure CORS
+let allowedHosts = [
+	'https://rapla.p4ddy.com',
+	'https://betterzon.p4ddy.com'
+];
+app.use(cors({
+	origin: function (origin: any, callback: any) {
+		// Allow requests with no origin
+		if (!origin) return callback(null, true);
+
+		// Block requests with wrong origin
+		if (allowedHosts.indexOf(origin) === -1) {
+			return callback(new Error('The CORS policy doesn\'t allow access for your origin.'), false);
+		}
+
+		// Allow all other requests
+		return callback(null, true);
+	}
+}));
 
 // Swagger documentation
 const swaggerDefinition = {
-    openapi: '3.0.0',
-    info: {
-        title: 'Pluto Development REST API',
-        version: '2.0.0',
-        license: {
-            name: 'Licensed Under MIT',
-            url: 'https://spdx.org/licenses/MIT.html'
-        },
-        contact: {
-            name: 'Pluto Development',
-            url: 'https://www.pluto-development.de'
-        }
-    }
+	openapi: '3.0.0',
+	info: {
+		title: 'Pluto Development REST API',
+		version: '2.0.0',
+		license: {
+			name: 'Licensed Under MIT',
+			url: 'https://spdx.org/licenses/MIT.html'
+		},
+		contact: {
+			name: 'Pluto Development',
+			url: 'https://www.pluto-development.de'
+		}
+	}
 };
 
 const options = {
-    swaggerDefinition,
-    // Paths to files containing OpenAPI definitions
-    apis: [
-        './src/models/**/*.router.ts'
-    ]
+	swaggerDefinition,
+	// Paths to files containing OpenAPI definitions
+	apis: [
+		'./src/models/**/*.router.ts'
+	]
 };
 
 const swaggerSpec = swaggerJSDoc(options);
 
 app.use(
-    '/docs',
-    swaggerUi.serve,
-    swaggerUi.setup(swaggerSpec)
+	'/docs',
+	swaggerUi.serve,
+	swaggerUi.setup(swaggerSpec)
 );
 
 // Add routers
@@ -77,9 +94,9 @@ app.use('/crr', crrRouter);
 
 // this is a simple route to make sure everything is working properly
 app.get('/', (req: express.Request, res: express.Response) => {
-    res.status(200).send('Welcome to the Pluto Development REST API V2!');
+	res.status(200).send('Welcome to the Pluto Development REST API V2!');
 });
 
 server.listen(port, () => {
-    logger.info('Server listening on Port ' + port);
+	logger.info('Server listening on Port ' + port);
 });