backend-app-api: readCorsOptions now disables cors by default

Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>

packages/backend-app-api/src/services/implementations/rootHttpRouter/readCorsOptions.test.ts

@@ -18,6 +18,12 @@ import { ConfigReader } from '@backstage/config';
 import { readCorsOptions } from './readCorsOptions';
 
 describe('readCorsOptions', () => {
+  it('should be disabled by default', () => {
+    expect(readCorsOptions(new ConfigReader({}))).toEqual({
+      origin: false,
+    });
+  });
+
   it('reads single string', () => {
     const mockCallback = jest.fn();
     const config = new ConfigReader({ cors: { origin: 'https://*.value*' } });

packages/backend-app-api/src/services/implementations/rootHttpRouter/readCorsOptions.ts

@@ -29,10 +29,10 @@ import { Minimatch } from 'minimatch';
  * const corsOptions = readCorsOptions(config.getConfig('backend'));
  * ```
  */
-export function readCorsOptions(config: Config): CorsOptions | undefined {
+export function readCorsOptions(config: Config): CorsOptions {
   const cc = config.getOptionalConfig('cors');
   if (!cc) {
-    return undefined;
+    return { origin: false }; // Disable CORS
   }
 
   return {