fix(backend): add CORSMiddleware with env-based dynamic origins and startup error handling

[Aryanbansal-05]

🔐 Summary

Resolves #3884 by registering CORSMiddleware in main.py using origins loaded dynamically from the ALLOWED_ORIGINS environment variable (already validated in config.py), replacing the missing/hardcoded wildcard configuration. Adds startup error handling so misconfigured CORS fails loudly with a logged error instead of silently allowing all origins.

---

🛠️ Changes Made

main.py — Register CORSMiddleware with env-based origins

Before:

• CORSMiddleware was imported but NEVER registered with app.add_middleware()
• All cross-origin requests were unprotected — no CORS policy was enforced at all

After:

• app.add_middleware(CORSMiddleware, ...) now registered at startup
• Origins loaded from settings.cors_origins (parses ALLOWED_ORIGINS env var)
• Explicit allowlist: GET, POST, PUT, PATCH, DELETE, OPTIONS
• Explicit headers: Authorization, Content-Type, X-CSRF-Token, X-Request-ID
• allow_credentials=True for cookie-based auth support
• Startup error caught and logged if ALLOWED_ORIGINS is empty or misconfigured
• Wildcard * is never used — all origins must be explicitly listed

.env.example

• Documented ALLOWED_ORIGINS with production + local dev defaults

---

✅ Security Issues Fixed

• 🔒 CORS policy now actually enforced (was missing entirely)
• 🔒 No wildcard * origins — explicit allowlist only
• 🔒 CORS misconfiguration on deployment fails with logged error
• 🔒 Origins validated at startup via config.py field_validator

---

Closes #3884

[vercel]

@Aryanbansal-05 is attempting to deploy a commit to the ritesh Team on Vercel.

A member of the Team first needs to authorize it.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 935b19f3-c666-444e-9987-1205c80f3c28

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Aryanbansal-05]

Hi @riteshbonthalakoti! The issue has been resolved and the PR is ready to get merged. Thankyou!