[SECURITY] Fix wide-open CORS configuration

[DevanshuNEU]

Problem

The current CORS configuration in backend/main.py allows requests from ANY origin with credentials enabled:

app.add_middleware(
    CORSMiddleware,
    allow_origins=["*"],  # ❌ Allows any website
    allow_credentials=True,
    allow_methods=["*"],
    allow_headers=["*"],
)

This is a serious security vulnerability. Any malicious website can make authenticated API requests on behalf of logged-in users.

Solution

Restrict CORS to specific allowed origins:

ALLOWED_ORIGINS = os.getenv("ALLOWED_ORIGINS", "http://localhost:3000").split(",")

app.add_middleware(
    CORSMiddleware,
    allow_origins=ALLOWED_ORIGINS,
    allow_credentials=True,
    allow_methods=["GET", "POST", "PUT", "DELETE", "OPTIONS"],
    allow_headers=["Authorization", "Content-Type"],
)

Acceptance Criteria

• CORS only allows specified origins
• Production origins configured via environment variable
• allow_origins=["*"] removed
• Update .env.example with ALLOWED_ORIGINS variable

Files to Modify

• backend/main.py
• .env.example
• backend/.env.example