Incorrect CORS Policy

Description:

Currently, there are some problems with the Cors Policy that I can see:

• Cors is only applied for the OPTIONS method
• Cors is not applied for resources
• Cors is not applied for GET request
• Cors is not applied for Apps Endpoints
• Cors is not applied for Websocket

Even if the current Cors policy can protect the user in most cases, but if we don't strictly follow the best practice, the vulnerabilities can be exploited in a way we cannot expect.

Steps to reproduce:

Expected behavior:

Cors policy is applied to all requests to the Rocket.Chat server

Actual behavior:

Cors policy is only applied to OPTIONS request of Rest API

Server Setup Information:

• Version of Rocket.Chat Server: latest
• Operating System: all
• Deployment Method: all
• Number of Running Instances: all
• DB Replicaset Oplog: all
• NodeJS Version: all
• MongoDB Version:all

Client Setup Information

• Desktop App or Browser Version:
• Operating System:

Additional context

Relevant logs:

Start by tracing how CORS is handled for the request categories named in the issue: OPTIONS, GET, other REST requests, resources, Apps Endpoints, and Websocket connections. Verify each category and consider the work done when the CORS policy is applied consistently to all requests to the Rocket.Chat server.