fix live leaderbord details

server.js

@@ -59,13 +59,33 @@ const ammcState = {
 };
 
 const app = express();
+const allowedCorsOrigins = new Set(
+  String(process.env.RC_ALLOWED_ORIGINS || "")
+    .split(",")
+    .map((origin) => origin.trim().replace(/\/$/, ""))
+    .filter(Boolean)
+);
+
 app.use(express.json({ limit: "20mb" }));
 app.use((req, res, next) => {
-  res.setHeader("Access-Control-Allow-Origin", "*");
-  res.setHeader("Access-Control-Allow-Methods", "GET,POST,OPTIONS");
-  res.setHeader("Access-Control-Allow-Headers", "Content-Type");
+  res.setHeader("X-Content-Type-Options", "nosniff");
+  res.setHeader("Referrer-Policy", "no-referrer");
+
+  const requestOrigin = `${req.protocol}://${req.get("host")}`;
+  const origin = String(req.get("origin") || "").replace(/\/$/, "");
+  const corsAllowed = !origin || origin === requestOrigin || allowedCorsOrigins.has(origin);
+  if (!corsAllowed) {
+    res.status(403).end();
+    return;
+  }
+  if (origin) {
+    res.setHeader("Access-Control-Allow-Origin", origin);
+    res.setHeader("Vary", "Origin");
+    res.setHeader("Access-Control-Allow-Methods", "GET,POST,OPTIONS");
+    res.setHeader("Access-Control-Allow-Headers", "Content-Type");
+  }
   if (req.method === "OPTIONS") {
-    res.status(204).end();
+    res.status(corsAllowed ? 204 : 403).end();
     return;
   }
   next();