harden notifications websocket cors

Author: barry01-hash

.env.example

@@ -18,6 +18,10 @@ REDIS_URL="redis://localhost:6379"
 # JWT
 JWT_SECRET=change-me-in-production
 
+# WebSocket CORS allowlist for /notifications (comma-separated origins)
+# JWT auth uses the Socket.IO handshake auth payload, so credentialed CORS is disabled.
+ALLOWED_ORIGINS=http://localhost:3000,http://localhost:3001
+
 # Admin wallet allowlist (comma-separated Stellar public keys)
 # On auth, any wallet in this list will receive role=ADMIN
 ADMIN_WALLETS=

src/notifications/notifications.gateway.spec.ts

@@ -0,0 +1,13 @@
+import { parseAllowedOrigins } from './notifications.gateway';
+
+describe('parseAllowedOrigins', () => {
+  it('returns an empty allowlist when the env var is missing', () => {
+    expect(parseAllowedOrigins(undefined)).toEqual([]);
+  });
+
+  it('splits and trims comma-separated origins', () => {
+    expect(
+      parseAllowedOrigins('http://localhost:3000, https://app.example.com ,'),
+    ).toEqual(['http://localhost:3000', 'https://app.example.com']);
+  });
+});

src/notifications/notifications.gateway.ts

@@ -10,6 +10,17 @@ import { JwtService } from '@nestjs/jwt';
 import { ConfigService } from '@nestjs/config';
 import type { Server, Socket } from 'socket.io';
 
+export function parseAllowedOrigins(value: string | undefined): string[] {
+  if (!value) {
+    return [];
+  }
+
+  return value
+    .split(',')
+    .map((origin) => origin.trim())
+    .filter(Boolean);
+}
+
 /**
  * WebSocket gateway providing real-time notification events.
  *
@@ -29,8 +40,9 @@ import type { Server, Socket } from 'socket.io';
 @WebSocketGateway({
   namespace: '/notifications',
   cors: {
-    origin: '*',
-    credentials: true,
+    // Socket.IO uses JWTs from the handshake auth payload, so credentialed CORS is unnecessary.
+    origin: parseAllowedOrigins(process.env.ALLOWED_ORIGINS),
+    credentials: false,
   },
 })
 export class NotificationsGateway