Fix gateway CORS for DNS deployment

Author: uo294819

.env.example

@@ -1,11 +1,12 @@
 JWT_SECRET=9fK2xPq7LmN4vR8sT1wZ6bH3cY5uJ0aQeD2nM7pL4x
 JWT_EXPIRES=1h
 GATEWAY_HTTPS_HOST=localhost
+GATEWAY_PUBLIC_HOSTNAME=localhost
+GATEWAY_ALLOWED_ORIGINS=
 GATEWAY_HTTPS_HOST_PORT=443
 GATEWAY_HTTP_HOST_PORT=8080
 PORT=8080
 HTTPS_PORT=8443
 HTTP_REDIRECT_ENABLED=false
-GATEWAY_PUBLIC_HOSTNAME=localhost
 HTTPS_CERT_PATH=
 HTTPS_KEY_PATH=

docker-compose.yml

@@ -50,6 +50,7 @@ services:
       - HTTP_REDIRECT_ENABLED=${HTTP_REDIRECT_ENABLED:-false}
       - GATEWAY_HTTPS_HOST=${GATEWAY_HTTPS_HOST:-localhost}
       - GATEWAY_PUBLIC_HOSTNAME=${GATEWAY_PUBLIC_HOSTNAME:-localhost}
+      - GATEWAY_ALLOWED_ORIGINS=${GATEWAY_ALLOWED_ORIGINS:-}
       - GATEWAY_HTTPS_HOST_PORT=${GATEWAY_HTTPS_HOST_PORT:-443}
       - HTTPS_CERT_PATH=${HTTPS_CERT_PATH:-}
       - HTTPS_KEY_PATH=${HTTPS_KEY_PATH:-}

gateway/gateway-service.js

@@ -201,6 +201,72 @@ function buildHttpsOrigin(hostname, httpsPort) {
   return `https://${normalizedHostname}${portSuffix}`;
 }
 
+function parseAllowedOrigins(value) {
+  const normalized = normalizeOptionalString(value);
+  if (!normalized) {
+    return [];
+  }
+
+  return normalized
+    .split(',')
+    .map((origin) => origin.trim())
+    .filter((origin) => origin.length > 0);
+}
+
+function parseOriginUrl(value) {
+  try {
+    return new URL(value);
+  } catch {
+    return null;
+  }
+}
+
+function normalizeHostname(value) {
+  const normalized = normalizeOptionalString(value);
+  if (!normalized) {
+    return null;
+  }
+
+  const asUrl = parseOriginUrl(normalized.includes('://') ? normalized : `https://${normalized}`);
+  return asUrl?.hostname ?? null;
+}
+
+function isOriginAllowedByHostname(origin, hostnames) {
+  const originUrl = parseOriginUrl(origin);
+  if (!originUrl) {
+    return false;
+  }
+
+  return hostnames
+    .map(normalizeHostname)
+    .filter(Boolean)
+    .some((hostname) => originUrl.hostname === hostname);
+}
+
+function isInternalApiOriginAllowed(origin, env = process.env) {
+  if (!origin) {
+    return true;
+  }
+
+  const allowedOrigins = parseAllowedOrigins(env.GATEWAY_ALLOWED_ORIGINS);
+  if (allowedOrigins.includes(origin)) {
+    return true;
+  }
+
+  return isOriginAllowedByHostname(origin, [
+    env.GATEWAY_PUBLIC_HOSTNAME,
+    env.GATEWAY_HTTPS_HOST,
+  ]);
+}
+
+function handleCorsError(error, _req, res, next) {
+  if (!error || error.message !== 'Not allowed by CORS for internal API') {
+    return next(error);
+  }
+
+  return res.status(403).json({ message: error.message });
+}
+
 function sanitizeRedirectPath(requestPath = '/') {
   if (typeof requestPath !== 'string' || requestPath.trim().length === 0 || !requestPath.startsWith('/')) {
     return '/';
@@ -963,18 +1029,18 @@ function createApp({
   app.use('/external', createExternalApiRouter({ env, fetchImpl, spec }));
 
   const serviceUrls = buildServiceUrls(env);
-  const publicHostname = env.GATEWAY_PUBLIC_HOSTNAME || 'localhost';
 
   // Stricter CORS for the internal API
   app.use('/api', cors({
     origin: (origin, callback) => {
-      if (!origin || origin.includes(publicHostname)) {
+      if (isInternalApiOriginAllowed(origin, env)) {
         callback(null, true);
       } else {
         callback(new Error('Not allowed by CORS for internal API'));
       }
     }
   }));
+  app.use('/api', handleCorsError);
 
   app.use('/api', createInternalApiRouter({ serviceUrls, fetchImpl }));
 
@@ -1061,6 +1127,7 @@ module.exports = {
   STRATEGY_TO_BOT_ID,
   applyBotMoveToYen,
   buildDocsHtml,
+  handleCorsError,
   buildProxy,
   buildRedirectDestination,
   buildHttpsOrigin,
@@ -1070,8 +1137,10 @@ module.exports = {
   getRedirectHostname,
   getProxyRoutes,
   getTlsConfig,
+  isInternalApiOriginAllowed,
   isDirectExecution,
   loadTlsOptions,
+  parseAllowedOrigins,
   sanitizeRedirectPath,
   pickPlayBotId,
   parseBoolean,

gateway/tests/services/gateway-service.test.js

@@ -16,7 +16,9 @@ const {
   createRedirectApp,
   getRedirectHostname,
   getTlsConfig,
+  isInternalApiOriginAllowed,
   loadTlsOptions,
+  parseAllowedOrigins,
   sanitizeRedirectPath,
   parseBoolean,
   start,
@@ -169,6 +171,59 @@ test('createApp sets expected proxy configuration for each route', () => {
   assert.equal(webappProxy.pathRewrite, undefined);
 });
 
+test('parseAllowedOrigins normalizes comma-separated CORS origins', () => {
+  assert.deepEqual(parseAllowedOrigins(' https://app.example.com,https://admin.example.com '), [
+    'https://app.example.com',
+    'https://admin.example.com',
+  ]);
+  assert.deepEqual(parseAllowedOrigins(''), []);
+});
+
+test('isInternalApiOriginAllowed accepts configured public hosts and explicit origins', () => {
+  assert.equal(isInternalApiOriginAllowed(undefined, {}), true);
+  assert.equal(
+    isInternalApiOriginAllowed('https://yovies4b.duckdns.org', {
+      GATEWAY_PUBLIC_HOSTNAME: 'yovies4b.duckdns.org',
+    }),
+    true,
+  );
+  assert.equal(
+    isInternalApiOriginAllowed('https://preview.example.com', {
+      GATEWAY_PUBLIC_HOSTNAME: 'yovies4b.duckdns.org',
+      GATEWAY_ALLOWED_ORIGINS: 'https://preview.example.com',
+    }),
+    true,
+  );
+  assert.equal(
+    isInternalApiOriginAllowed('https://evil-yovies4b.duckdns.org', {
+      GATEWAY_PUBLIC_HOSTNAME: 'yovies4b.duckdns.org',
+    }),
+    false,
+  );
+});
+
+test('internal API returns 403 instead of 500 when CORS rejects the origin', async () => {
+  const { app } = createApp({
+    proxyFactory: noopProxyFactory,
+    env: { GATEWAY_PUBLIC_HOSTNAME: 'yovies4b.duckdns.org' },
+  });
+
+  await withServer(app, async (baseUrl) => {
+    const response = await fetch(`${baseUrl}/api/v1/matchmaking/enqueue`, {
+      method: 'POST',
+      headers: {
+        Origin: 'https://wrong.example.com',
+        'Content-Type': 'application/json',
+      },
+      body: JSON.stringify({ size: 7 }),
+    });
+    const body = await response.json();
+
+    assert.equal(response.status, 403);
+    assert.equal(body.message, 'Not allowed by CORS for internal API');
+  });
+});
+
 // buildProxy returns a 502 response when upstream fails.
 test('buildProxy returns a 502 response when upstream fails', () => {
   let capturedConfig;