In config > env > staging.js

[...]

//--------------------------------------------------------------------------
//      Security Settings Configuraiton
//--------------------------------------------------------------------------

security: Object.assign({}, PRODUCTION_CONFIG.security, {

  cors: {
    allRoutes: true,
    onlyAllowOrigins: [
      'https://app-frontend.mydomain.com',
      'https://app-frontend.herokuapp.com'
    ],
    allowRequestHeaders: 'Content-Type, Authorization'
  }

}),

//--------------------------------------------------------------------------
//      WebSocket Server Settings Configuration
//--------------------------------------------------------------------------

sockets: Object.assign({}, PRODUCTION_CONFIG.sockets, {

  onlyAllowOrigins: [
    'https://app-frontend.mydomain.com',
    'https://app-frontend.herokuapp.com'
  ]

}),

[...]

In config > prod.env.js

'use strict'
module.exports = {
  NODE_ENV: '"production"',
  HOST: '"https://*app-frontend*.herokuapp.com"'
  VUE_APP_BASE_URL: '"https://*app-backend*.herokuapp.com"'
}