Cross-Domain Misconfiguration on Stackle App

[thishnika]

Fixes CWE-264, CWE-269, CWE-269 & WASC-14 vulnerabilities on Stackle-app

Changes proposed in the pull request

Configure the "Access-Control-Allow-Origin" HTTP response header to a more restrictive set of domains, instead of the wildcard (*)

Impact

Allows the web browsers to enforce the Same Origin Policy (SOP) in a more restrictive manner

Other information

References

1. http://www.hpenterprisesecurity.com/vulncat/en/vulncat/vb/html5_overly_permissive_cors_policy.html
2. https://www.packetlabs.net/cross-origin-resource-sharing-cors/