Applied configurable CORS policy to API

PostFundManagement.Api/Program.cs

@@ -91,6 +91,19 @@ builder.Services.AddOpenApi(options =>
     });
 });
 
+var allowedOrigins = builder.Configuration.GetSection("CorsOrigins").Get<string[]>() ?? [];
+
+builder.Services.AddCors(options =>
+{
+    options.AddPolicy("AllowConfiguredOrigins", policy =>
+    {
+        policy.WithOrigins(allowedOrigins)
+              .AllowAnyHeader()
+              .AllowAnyMethod()
+              .AllowCredentials();
+    });
+});
+
 var app = builder.Build();
 
 var schedulerFactory = app.Services.GetRequiredService<ISchedulerFactory>();
@@ -101,10 +114,10 @@ if (!scheduler!.IsStarted)
 
 app.UseHsts();
 app.UseHttpsRedirection();
-
 app.UseRouting();
-
+app.UseCors("AllowConfiguredOrigins");
 app.UseOutputCache();
+
 app.UseAuthentication();
 app.UseAuthorization();
 

PostFundManagement.Api/appsettings.json

@@ -1,4 +1,8 @@
 {
+  "CorsOrigins": [
+    "https://console.ifri.khongisa.co.za",
+    "https://localhost:7208"
+  ],
   "GeneralS3Settings": {
     "ServiceUrl": "https://s3.garage.khongisa.co.za",
     "Region": "garage",

docker-compose.yml

@@ -13,6 +13,11 @@ services:
       - ForwardedHeadersConfiguration__Enabled=true
       - ForwardedHeadersConfiguration__AllowAll=true
       - ForwardedHeadersConfiguration__ForwardLimit=1
+
+      # CORS Overrides
+      - CorsOrigins__0=${CORS_ORIGIN_CONSOLE:-https://console.ifri.khongisa.co.za}
+      - CorsOrigins__1=${CORS_ORIGIN_API:-https://api.ifri.khongisa.co.za}
+      - CorsOrigins__2=${CORS_ORIGIN_LOCAL:-https://localhost:7208}
       
       # Postgres Database Overrides      
       - ConnectionStrings__PfmDatabase=Server=${POSTGRES_HOST:-192.168.1.170};Port=${POSTGRES_PORT:-5432};Database=${POSTGRES_DB:-pfm};User Id=${POSTGRES_USER:-pfm-user};Password=${POSTGRES_PASSWORD};