Securised CORS

server.js

@@ -31,10 +31,9 @@ app.use(bodyParser.urlencoded({ extended: true }));
 app.use(bodyParser.json());
 
 
-// Allow cross-origin requests. Wildcard for now, we'll see if we can improve
-// that.
+// Allow cross-origin requests.
 app.all('/*', function(req, res, next) {
-    res.header('Access-Control-Allow-Origin', '*');
+    res.header('Access-Control-Allow-Origin', settings.formUrl);
     res.header('Access-Control-Allow-Headers', 'Content-Type')
     next();
 });

settings.example.json

@@ -5,12 +5,13 @@
         "port": 465,
         "secure": true,
         "auth": {
-            "user": "noreply@noreply.tld",
+            "user": "noreply@example.tld",
             "pass": "hackme"
         }
     },
     "recipients": [
         "you@example.tld",
         "someone.else@example.com"
-    ]
+    ],
+    "formUrl": "https://example.tld/contact"
 }