Feature #11370
openi am checking overall ui in e-commerce and admin pannel (Manage Notifications Page, Application Root Theme Entry,Global Stylesheet, Manage Notifications, Product Details, Products Listing Checkout & Cart Layout & Navigation Application Bootstrap & COR )
Subtasks
Related issues
Updated by Karthik Palakonda 14 days ago
- Due date set to 10/07/2026
- Status changed from In Progress to Resolved
- % Done changed from 0 to 100
| 2.5 hrs | Bug Investigation & Root Cause Analysis | Debugged staging login OTP failure (`POST /api/auth/send-otp` returning 400 Bad Request on `test.shop.noxajewels.com`). Traced request flow, verified authentication endpoints, and isolated the issue to CORS origin validation failures triggering unhandled server exceptions. |
| 2.0 hrs | CORS Architecture & Security Hardening | Refactored CORS configuration in NestJS backend (`main.ts`). Implemented dynamic domain and subdomain validation (`*.noxajewels.com`), replaced exception-throwing callbacks with standard CORS rejection (`callback(null, false)`), and configured environment origins in `.env`. |
| 1.5 hrs | Production Security Hardening Review | Conducted security audit of CORS and middleware policies. Enforced HTTPS-only protocols for production domains, isolated `localhost` / `127.0.0.1` exclusively to non-production environments, and verified 10MB payload thresholds against DoS risks. |
| 2.0 hrs | API Testing, Build Verification & Documentation | Validated fix with cross-origin test scripts simulating browser preflight (OPTIONS) and POST requests. Verified zero compilation errors via `npm run build`, verified local dev server stability, and documented staging deployment steps. |
- Copy-Paste Format for Redmine Ticket / Comments
Date: Today
Total Hours Logged: 8.0 hrs
Activity: Development & Bug FixingWork Done:
1. Staging Authentication Issue Investigation (2.5h):
- Investigated `400 Bad Request` during login OTP delivery on `test.shop.noxajewels.com`.
- Discovered that the origin header sent by browsers was being rejected by the backend's strict CORS validator, which threw an unhandled Error that the global filter converted to an HTTP 400.2. CORS Security & Infrastructure Fix (2.0h):
- Refactored `main.ts` CORS logic to dynamically support all `noxajewels.com` domains and subdomains (`shop`, `test.shop`, `admin`, `test.admin`).
- Replaced `callback(new Error(...))` with compliant `callback(null, false)` to prevent unhandled server exceptions.
- Updated environment origin definitions in `.env`.3. Production Security Hardening (1.5h):
- Enforced mandatory `https://` protocol for production domains to mitigate MitM vulnerabilities.
- Restricted `localhost` and `127.0.0.1` origin access strictly to local/dev mode (`NODE_ENV !== 'production'`).
- Verified body-parser limits (10MB) and raw payload handling for Stripe webhooks.4. Testing, Build & Validation (2.0h):
- Executed automated API test scripts with various Origin header combinations to confirm 200 OK responses.
- Ran full NestJS production build (`npm run build`) with zero errors.
- Prepared deployment instructions for staging release.
Updated by Karthik Palakonda 14 days ago
- Subject changed from i am checking overall ui in e-commerce and admin pannel to i am checking overall ui in e-commerce and admin pannel (Manage Notifications Page, Application Root Theme Entry,Global Stylesheet, Manage Notifications, Product Details, Products Listing Checkout & Cart Layout & Navigation Application Bootstrap & COR )
Updated by Karthik Palakonda 14 days ago
- Due date changed from 10/07/2026 to 10/08/2026
- Status changed from Resolved to In Progress
- % Done changed from 100 to 60