Allow CORS for all origins

(fixes juice-shop#182)

Gruntfile.js

@@ -92,6 +92,7 @@ module.exports = function (grunt) {
  'node_modules/serve-index/**',
  'node_modules/serve-favicon/**',
  'node_modules/body-parser/**',
+ 'node_modules/cors/**',
  'node_modules/sequelize-restful/**',
  'node_modules/morgan/**',
  'node_modules/sanitize-html/**',

package.json

@@ -30,6 +30,7 @@
  "serve-index": "~1.8",
  "serve-favicon": "~2.3",
  "body-parser": "~1.15",
+ "cors": "~2.8",
  "sequelize-restful": "~0.4",
  "morgan": "~1.7",
  "sanitize-html": "1.4.2",

server.js

@@ -14,6 +14,7 @@ var application_root = __dirname.replace(/\\/g, '/'),
  serveIndex = require('serve-index'),
  favicon = require('serve-favicon'),
  bodyParser = require('body-parser'),
+ cors = require('cors'),
  redirect = require('./routes/redirect'),
  angular = require('./routes/angular'),
  easterEgg = require('./routes/easterEgg'),
@@ -48,6 +49,9 @@ app.use(helmet.noSniff());
 app.use(helmet.frameguard());
 //app.use(helmet.xssFilter()); // = no protection from persisted XSS via RESTful API
 
+/* Bludgeon solution for possible CORS problems: Allow everything! */
+app.use(cors());
+
 /* Remove duplicate slashes from URL which allowed bypassing subsequent filters */
 app.use(function (req,res,next) { req.url = req.url.replace(/[/]+/g, '/'); next(); });