[TAN-1331] Do not allow any cross-origin requests on production

[jinjagit]

trafficstars

• Works when tested functionally, locally
• Unsure how to test more robustly, other than on staging after merging, and then release to production if all looks OK.
• New spec doesn't really test anything. It does document how the origins config works, so maybe it's useful?
• I'd really like to abstract the body of the allow block in cors.rb into a class method, to facilitate testing of different origin values without having to stub the entire Rack::Cors middleware, but I think it's likely impossible in such an initializer file.
• Given that all environments, except development, now do not permit any CORS origins, I also wonder if it would be better to have this as the default config in config/application.rb and only override it it config/environments/development.rb

Changelog

Technical

• [TAN-1331] Do not allow any cross-origin requests on production

[notion-workspace[bot]]

🟡 [AD7] Cross-Origin Resource Sharing

[cl-dev-bot]

	Warnings
:warning:	The PR title contains no Jira issue key (case-sensitive)
:warning:	The branch name contains no Jira issue key (case-sensitive)

	Messages
:book:	Changelog provided 🎉
:book:	Run the e2e tests
:book:	Check translation progress

Generated by :no_entry_sign: dangerJS against ccf7ddbb3c92673ceef877c409947e8a6aa0d097

[jinjagit]

@adessy Changed reviewer to you, given Koen will be off for 2 weeks. He was broadly in agreement with my plan to just try this on staging , then release if seems OK. Tests are largely useless, though might be useful as documentation of how rack-cors works?

[jinjagit]

@adessy I've disabled CORS in development, as discussed in our platform week meetings recently.

Kind of hard to test, with various issues/errors when functionally testing the widget tool in all environments except production at the moment. See Slack thread.