From e8d2de592dd933195be0508c3f3fab87d035c833 Mon Sep 17 00:00:00 2001
From: Patrik Oldsberg <poldsberg@gmail.com>
Date: Thu, 5 Jan 2023 13:33:13 +0100
Subject: [PATCH] backend-app-api: readCorsOptions now disables cors by default

Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
---
 .../implementations/rootHttpRouter/readCorsOptions.test.ts  | 6 ++++++
 .../implementations/rootHttpRouter/readCorsOptions.ts       | 4 ++--
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/packages/backend-app-api/src/services/implementations/rootHttpRouter/readCorsOptions.test.ts b/packages/backend-app-api/src/services/implementations/rootHttpRouter/readCorsOptions.test.ts
index 1c70d020c4..113b2a8ee6 100644
--- a/packages/backend-app-api/src/services/implementations/rootHttpRouter/readCorsOptions.test.ts
+++ b/packages/backend-app-api/src/services/implementations/rootHttpRouter/readCorsOptions.test.ts
@@ -18,6 +18,12 @@ import { ConfigReader } from '@backstage/config';
 import { readCorsOptions } from './readCorsOptions';
 
 describe('readCorsOptions', () => {
+  it('should be disabled by default', () => {
+    expect(readCorsOptions(new ConfigReader({}))).toEqual({
+      origin: false,
+    });
+  });
+
   it('reads single string', () => {
     const mockCallback = jest.fn();
     const config = new ConfigReader({ cors: { origin: 'https://*.value*' } });
diff --git a/packages/backend-app-api/src/services/implementations/rootHttpRouter/readCorsOptions.ts b/packages/backend-app-api/src/services/implementations/rootHttpRouter/readCorsOptions.ts
index 17c3157ebd..809ee9b527 100644
--- a/packages/backend-app-api/src/services/implementations/rootHttpRouter/readCorsOptions.ts
+++ b/packages/backend-app-api/src/services/implementations/rootHttpRouter/readCorsOptions.ts
@@ -29,10 +29,10 @@ import { Minimatch } from 'minimatch';
  * const corsOptions = readCorsOptions(config.getConfig('backend'));
  * ```
  */
-export function readCorsOptions(config: Config): CorsOptions | undefined {
+export function readCorsOptions(config: Config): CorsOptions {
   const cc = config.getOptionalConfig('cors');
   if (!cc) {
-    return undefined;
+    return { origin: false }; // Disable CORS
   }
 
   return {