ضبط CORS المتقدم

Origin: https://frontend.com
Access-Control-Allow-Origin: https://frontend.com

const cors = require('cors');

// السماح لكل النطاقات (للتطوير فقط)
app.use(cors());

const whitelist = ['https://frontend.com', 'https://admin.frontend.com'];

const corsOptions = {
  origin: (origin, callback) => {
    if (whitelist.indexOf(origin) !== -1 || !origin) {
      callback(null, true);
    } else {
      callback(new Error('Not allowed by CORS'));
    }
  },
  credentials: true,
  methods: ['GET', 'POST', 'PUT', 'DELETE'],
  allowedHeaders: ['Content-Type', 'Authorization'],
};

app.use(cors(corsOptions));

app.options('*', cors(corsOptions)); // معالجة preflight

const corsOptions = {
  origin: 'https://frontend.com',
  credentials: true, // يسمح بإرسال cookies
};

const productionCors = {
  origin: [
    'https://example.com',
    'https://www.example.com',
    'https://api.example.com',
  ],
  credentials: true,
  maxAge: 86400, // تخزين نتيجة preflight ليوم واحد
  exposedHeaders: ['X-Total-Count', 'X-Rate-Limit'],
};

const helmet = require('helmet');
const cors = require('cors');

app.use(helmet());
app.use(cors(corsOptions));

const origins = process.env.CORS_ORIGINS?.split(',') || ['http://localhost:3000'];

app.use(cors({
  origin: origins,
  credentials: true,
}));