feat(backend): configure secure CORS

Author: Heet27

backend-api/app/main.py

@@ -1,10 +1,12 @@
 from fastapi import FastAPI
 from fastapi.middleware.cors import CORSMiddleware
-from app.core.logging import setup_logging
+
 from app.api.v1.router import api_router
 from app.core.config import get_settings
+from app.core.errors import NotFound, not_found_handler
+from app.core.logging import setup_logging
 from app.core.middleware import RequestLoggingMiddleware
-from app.core.errors import not_found_handler, NotFound
+
 settings = get_settings()
 
 
@@ -16,15 +18,17 @@ def create_app() -> FastAPI:
     # (middleware executes in reverse order - last added runs first)
     app.add_middleware(RequestLoggingMiddleware)
 
-    # Allow frontend (localhost:3000 and others) to call the API during development.
-    # CORS must be added last so it runs first and wraps all responses including errors.
+    # Allow the configured frontend to make credentialed API requests.
+    # Expose X-Request-ID so the frontend can use it when reporting errors.
     app.add_middleware(
         CORSMiddleware,
-        allow_origins=["*"],  # permissive for dev; adjust in prod
-        allow_credentials=False,  # must be False when using wildcard origins
+        allow_origins=[settings.FRONTEND_URL.rstrip("/")],
+        allow_credentials=True,
         allow_methods=["*"],
         allow_headers=["*"],
+        expose_headers=["X-Request-ID"],
     )
+
     app.include_router(api_router, prefix=settings.API_PREFIX)
 
     # error handler
@@ -39,7 +43,8 @@ def health_check():
         return {
             "status": "healthy",
         }
-        
+
     return app
 
+
 app = create_app()