Tech Debt: Audit and Tighten CORS Configuration for Pay‑API*

## **Summary**

Our current CORS configuration may still include outdated or overly permissive origins (e.g., Cloud Run URLs or wildcard entries). This needs a full review to ensure only approved domains are allowed.

***

## **Background**

Recent internal discussions identified several possible gaps:

* The Pay‑API backend may still allow its **Cloud Run service URL** as an origin.
* CORS restrictions may not be limited strictly to approved **gov.bc.ca** domains.
* Over‑permissive CORS could allow a malicious external site to make browser‑attached authenticated calls to Pay‑API.
* Login tokens (Keycloak JWTs) in PROD are URL‑restricted, but CORS is still required to prevent browsers from being leveraged against authenticated users.
* Need to confirm whether any partner domains (e.g., **bcassessment.ca**) legitimately rely on the service.

This creates unnecessary security exposure and constitutes technical debt.

***

## **Work Required**

### **1. Audit existing CORS configuration**

* Inspect the list of allowed origins in Pay‑API.
* Confirm whether the Cloud Run URL is still present.
* Check for wildcard (`*`) or pattern‑based origins.

### **2. Verify actual runtime usage**

* Identify which frontend domains currently call Pay‑API.
* Validate behaviour of Keycloak login tokens vs. browser CORS enforcement.

### **3. Confirm allowed/required domains**

* Validate all **gov.bc.ca** frontends that should be permitted.
* Review whether partner domains (ex: *bcassessment.ca*) require access.

### **4. Update and harden CORS configuration**

* Remove Cloud Run URLs.
* Remove wildcard origins.
* Add only verified approved domains.

### **5. Regression test**

* Ensure all legitimate frontends continue to function normally.
* Confirm unauthorized origins are blocked.

***

## **Acceptance Criteria**

* No wildcard origins exist in configuration.
* Cloud Run service URLs removed from allowed origins.
* Only approved gov.bc.ca + verified partner domains are allowed.
* Updated documentation listing all approved origins.
* Security/architecture teams notified after completion.

***

## **Risk**

If not addressed:

* Browsers could unintentionally attach authenticated cookies or tokens to requests from malicious origins.
* Increased exposure to cross‑site request misuse scenarios.
* Potential misalignment with security reviews and audit requirements.