[Security] Wildcard CORS (cors('*')) Allows Cross-Origin Account Enumeration and Signup Abuse in server.js

[advikdivekar]

Description:
A CRITICAL security vulnerability exists in backend/server.js at line 16. The server applies app.use(cors('*')) — a fully open wildcard CORS policy — across every API endpoint including /api/auth/signup and /api/auth/login. This means any JavaScript running on any origin can freely call these endpoints and read the full response body.

Impact:
An attacker can host a malicious page that silently abuses the open API:

• Account enumeration at scale: Call POST /api/auth/signup for thousands of emails; a 400 "User already exists" response reveals the account is registered, a 201 means it is free.
• Unsolicited account creation: The attacker can register arbitrary accounts consuming target email addresses, locking real users out of signup.
• Combined with Issue [Security] User Enumeration via Differential Authentication Error Messages in passportConfig.js #445 (differential error messages): A cross-origin script can enumerate the full user database in seconds with no rate-limit bypass required.
• Future risk: Any authenticated data endpoint added later will also be exposed to cross-origin readers because Access-Control-Allow-Origin: * is already set globally.

Steps to Reproduce:

1. From a page on https://evil.com, run:

fetch('http://localhost:5000/api/auth/signup', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ username: 'probe', email: 'victim@company.com', password: 'Aa1@aaaa' })
}).then(r => r.json()).then(console.log);

2. Browser allows the request and returns the full response (no CORS block).
3. 400 "User already exists" → victim@company.com is registered.

Expected Behaviour:
CORS should only allow requests from the known frontend origins (e.g., http://localhost:5173 in development, the production domain in production). Requests from all other origins should be rejected by the browser with a CORS error.

Proposed Fix:
Replace the wildcard with an allowlist driven by an environment variable:

// server.js
const allowedOrigins = (process.env.ALLOWED_ORIGINS || 'http://localhost:5173').split(',');
app.use(cors({
    origin: (origin, callback) => {
        if (!origin || allowedOrigins.map(o => o.trim()).includes(origin)) {
            callback(null, true);
        } else {
            callback(new Error('Not allowed by CORS'));
        }
    },
    credentials: true,
}));

Add to .env.sample:

ALLOWED_ORIGINS=http://localhost:5173

Labels: type:bug level:advanced gssoc:approved gssoc26

Please assign this issue to me under GSSoC 2026. I will open a PR with a complete fix covering all affected files, proper test coverage, and verification steps.