Restrict CORS to localhost origins

server.go

@@ -585,11 +585,14 @@ func (s *Server) handleStats(w http.ResponseWriter, r *http.Request) {
 	json.NewEncoder(w).Encode(stats)
 }
 
-// corsMiddleware adds CORS headers for local development
+// corsMiddleware adds CORS headers restricted to localhost origins
 func corsMiddleware(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		// Allow requests from any origin (localhost only anyway)
-		w.Header().Set("Access-Control-Allow-Origin", "*")
+		origin := r.Header.Get("Origin")
+		if isLocalhostOrigin(origin) {
+			w.Header().Set("Access-Control-Allow-Origin", origin)
+			w.Header().Set("Vary", "Origin")
+		}
 		w.Header().Set("Access-Control-Allow-Methods", "GET, POST, OPTIONS")
 		w.Header().Set("Access-Control-Allow-Headers", "Content-Type")
 
@@ -603,6 +606,14 @@ func corsMiddleware(next http.Handler) http.Handler {
 	})
 }
 
+// isLocalhostOrigin returns true if the origin is a localhost address
+func isLocalhostOrigin(origin string) bool {
+	return origin == "http://localhost" ||
+		origin == "http://127.0.0.1" ||
+		strings.HasPrefix(origin, "http://localhost:") ||
+		strings.HasPrefix(origin, "http://127.0.0.1:")
+}
+
 // StartServer is a convenience function to start a server
 func StartServer(port int, outputDir string, projects []Project) error {
 	server, err := NewServer(port, outputDir, projects)

server_test.go

@@ -403,17 +403,48 @@ func TestCorsMiddleware(t *testing.T) {
 		w.WriteHeader(http.StatusOK)
 	}))
 
-	// Test regular request
+	// Test localhost origin - should be allowed
 	req := httptest.NewRequest(http.MethodGet, "/", nil)
+	req.Header.Set("Origin", "http://localhost:8080")
 	rr := httptest.NewRecorder()
 	handler.ServeHTTP(rr, req)
 
-	if rr.Header().Get("Access-Control-Allow-Origin") != "*" {
-		t.Error("CORS header should be set")
+	if rr.Header().Get("Access-Control-Allow-Origin") != "http://localhost:8080" {
+		t.Errorf("CORS should reflect localhost origin, got %q", rr.Header().Get("Access-Control-Allow-Origin"))
+	}
+
+	// Test 127.0.0.1 origin - should be allowed
+	req = httptest.NewRequest(http.MethodGet, "/", nil)
+	req.Header.Set("Origin", "http://127.0.0.1:3000")
+	rr = httptest.NewRecorder()
+	handler.ServeHTTP(rr, req)
+
+	if rr.Header().Get("Access-Control-Allow-Origin") != "http://127.0.0.1:3000" {
+		t.Errorf("CORS should reflect 127.0.0.1 origin, got %q", rr.Header().Get("Access-Control-Allow-Origin"))
+	}
+
+	// Test external origin - should NOT be allowed
+	req = httptest.NewRequest(http.MethodGet, "/", nil)
+	req.Header.Set("Origin", "https://evil.com")
+	rr = httptest.NewRecorder()
+	handler.ServeHTTP(rr, req)
+
+	if rr.Header().Get("Access-Control-Allow-Origin") != "" {
+		t.Errorf("CORS should not allow external origins, got %q", rr.Header().Get("Access-Control-Allow-Origin"))
+	}
+
+	// Test no origin header - should NOT set CORS header
+	req = httptest.NewRequest(http.MethodGet, "/", nil)
+	rr = httptest.NewRecorder()
+	handler.ServeHTTP(rr, req)
+
+	if rr.Header().Get("Access-Control-Allow-Origin") != "" {
+		t.Errorf("CORS should not be set without Origin header, got %q", rr.Header().Get("Access-Control-Allow-Origin"))
 	}
 
 	// Test preflight
 	req = httptest.NewRequest(http.MethodOptions, "/", nil)
+	req.Header.Set("Origin", "http://localhost:8080")
 	rr = httptest.NewRecorder()
 	handler.ServeHTTP(rr, req)
 
@@ -422,6 +453,30 @@ func TestCorsMiddleware(t *testing.T) {
 	}
 }
 
+func TestIsLocalhostOrigin(t *testing.T) {
+	tests := []struct {
+		origin string
+		want   bool
+	}{
+		{"http://localhost", true},
+		{"http://localhost:8080", true},
+		{"http://localhost:3000", true},
+		{"http://127.0.0.1", true},
+		{"http://127.0.0.1:8080", true},
+		{"https://evil.com", false},
+		{"http://localhost.evil.com", false},
+		{"", false},
+		{"http://0.0.0.0:8080", false},
+	}
+
+	for _, tt := range tests {
+		got := isLocalhostOrigin(tt.origin)
+		if got != tt.want {
+			t.Errorf("isLocalhostOrigin(%q) = %v, want %v", tt.origin, got, tt.want)
+		}
+	}
+}
+
 func TestSearchResponseFormat(t *testing.T) {
 	now := time.Now()
 	projects := []Project{