From 9d87e1b1bc3015b0878e7689e0f868a414aa48de Mon Sep 17 00:00:00 2001
From: Collin Barrett <6483057+collinbarrett@users.noreply.github.com>
Date: Sun, 1 Jun 2025 12:16:23 -0500
Subject: [PATCH] Revert "refactor(api): loosen CORS to allow CF edge cache"

This reverts commit ec1e006dc837079bb251d1dde6ee376ee8af73f9.
---
 .../CorsConfiguration.cs                      | 21 ++++++++++++-------
 1 file changed, 14 insertions(+), 7 deletions(-)

diff --git a/services/Directory/FilterLists.Directory.Api/CorsConfiguration.cs b/services/Directory/FilterLists.Directory.Api/CorsConfiguration.cs
index 232cf9b9a..14f2242f9 100644
--- a/services/Directory/FilterLists.Directory.Api/CorsConfiguration.cs
+++ b/services/Directory/FilterLists.Directory.Api/CorsConfiguration.cs
@@ -4,11 +4,18 @@ namespace FilterLists.Directory.Api;
 
 internal static class CorsConfiguration
 {
-    internal static readonly Action<CorsOptions> SetupAction = options =>
-        options.AddDefaultPolicy(policy =>
-            policy
-                .AllowAnyOrigin()
-                .WithMethods("GET")
-                .AllowAnyHeader()
-        );
+    private const string ProductionClientOrigin = "https://filterlists.com";
+    private const string StagingClientOriginStart = "https://nice-water-05873140f";
+    private const string StagingClientOriginEnd = ".eastus2.5.azurestaticapps.net";
+    private const string LocalClientOrigin = "http://localhost:3000";
+
+    internal static readonly Action<CorsOptions> SetupAction = options => options.AddDefaultPolicy(policy =>
+    {
+        policy.SetIsOriginAllowed(origin =>
+                origin is ProductionClientOrigin or LocalClientOrigin ||
+                (origin.StartsWith(StagingClientOriginStart, StringComparison.InvariantCulture) &&
+                 origin.EndsWith(StagingClientOriginEnd, StringComparison.InvariantCulture)))
+            .WithMethods("GET")
+            .AllowAnyHeader();
+    });
 }
\ No newline at end of file