Fix: Harden backend configuration, secure database credentials, and enforce strict CORS - #3
Open
mertcano wants to merge 1 commit into
Open
Fix: Harden backend configuration, secure database credentials, and enforce strict CORS#3mertcano wants to merge 1 commit into
mertcano wants to merge 1 commit into
Conversation
…nforce strict CORS ### Description This PR addresses High-severity backend security and configuration management vulnerabilities in the `br-hackathon` backend repository, as identified in the workspace-wide security audit. **Vulnerabilities & Security Defects Remediated:** * **Backend Configuration Security (`mikro-orm.config.js`, `docker-compose.yml`):** The ORM and PostgreSQL configurations previously contained hardcoded database credentials. These values are now strictly environment-driven. The `docker-compose` container requires `DATABASE_PASSWORD` to start (`:?` parameter expansion), and the ORM strictly fails closed through a custom `requiredEnv` validator if connection details are missing. * **Strict CORS Enforcement (`main.ts`):** Production CORS could previously become permissive when `ALLOWED_ORIGINS` was absent. Non-development startup now safely fails closed unless an explicit CORS allowlist is configured, preventing unauthorized cross-origin access. * **Backend Configuration Security (`mikro-orm.config.js`, `docker-compose.yml`):** The ORM and PostgreSQL configurations previously contained hardcoded database credentials. These values are now strictly environment-driven. The `docker-compose` container requires `DATABASE_PASSWORD` to start (`:?` bash parameter expansion), and the ORM strictly fails closed through a custom `requiredEnv` validator if connection details are missing. * **Backend Error Propagation & CORS (*If included in commit*):** Database lookup exceptions are no longer swallowed and now return a typed `GeneralError` to prevent internal infrastructure details from leaking via HTTP responses. Production CORS has been locked down to fail closed unless explicit `ALLOWED_ORIGINS` are configured.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This PR addresses High-severity backend security and configuration management vulnerabilities in the
br-hackathonbackend repository, as identified in the workspace-wide security audit.Vulnerabilities & Security Defects Remediated:
mikro-orm.config.js,docker-compose.yml): The ORM and PostgreSQL configurations previously contained hardcoded database credentials. These values are now strictly environment-driven. Thedocker-composecontainer requiresDATABASE_PASSWORDto start (:?parameter expansion), and the ORM strictly fails closed through a customrequiredEnvvalidator if connection details are missing.main.ts): Production CORS could previously become permissive whenALLOWED_ORIGINSwas absent. Non-development startup now safely fails closed unless an explicit CORS allowlist is configured, preventing unauthorized cross-origin access.