CORS whitelist for NodeJS

nodejs/server.js

@@ -7,7 +7,7 @@ const { Server } = require('socket.io');
 const app        = express();
 const httpServer = createServer(app);
 const io         = new Server(httpServer, {
-    cors: { origin: '*' }
+    cors: { origin: process.env.ALLOWED_ORIGIN || 'http://localhost' }
 });
 
 app.use(express.json());