From ac922ac04ea8c7f113efc0c506b8772018fa9bc5 Mon Sep 17 00:00:00 2001
From: mrugesh <1884376+raisedadead@users.noreply.github.com>
Date: Tue, 3 Mar 2020 20:32:04 +0530
Subject: [PATCH] fix: add pass thru for some subdomains (#38315)

* fix: add passthru for some subdomains

* fix: export whitelist correctly
---
 api-server/server/middlewares/constant-headers.js | 11 ++++++++++-
 config/cors-settings.js                           |  8 ++++++++
 2 files changed, 18 insertions(+), 1 deletion(-)
 create mode 100644 config/cors-settings.js

diff --git a/api-server/server/middlewares/constant-headers.js b/api-server/server/middlewares/constant-headers.js
index bca08ce7b1b..7742c49ff3b 100644
--- a/api-server/server/middlewares/constant-headers.js
+++ b/api-server/server/middlewares/constant-headers.js
@@ -1,8 +1,17 @@
 import { homeLocation } from '../../../config/env';
+import { whitelistOrigins } from '../../../config/cors-settings';
 
 export default function constantHeaders() {
   return function(req, res, next) {
-    res.header('Access-Control-Allow-Origin', homeLocation);
+    if (
+      req.headers &&
+      req.headers.origin &&
+      whitelistOrigins.includes(req.headers.origin)
+    ) {
+      res.header('Access-Control-Allow-Origin', req.headers.origin);
+    } else {
+      res.header('Access-Control-Allow-Origin', homeLocation);
+    }
     res.header('Access-Control-Allow-Credentials', true);
     res.header(
       'Access-Control-Allow-Headers',
diff --git a/config/cors-settings.js b/config/cors-settings.js
new file mode 100644
index 00000000000..ba83f1849f8
--- /dev/null
+++ b/config/cors-settings.js
@@ -0,0 +1,8 @@
+exports.whitelistOrigins = [
+  'https://www.freecodecamp.dev',
+  'https://www.freecodecamp.org',
+  'https://beta.freecodecamp.dev',
+  'https://beta.freecodecamp.org',
+  'https://chinese.freecodecamp.dev',
+  'https://chinese.freecodecamp.org'
+];