nandi.uk / semble
This repository has no description
0
Fork 0

Configure Feed

Select the types of activity you want to include in your feed.

allow wildcards for non semble origins (will be useful for api, these requests can't use cookies)

author
Wesley Finck date (May 13, 2026, 9:52 PM -0700) commit b2490d47 parent ebc34d9c
+43 -8
+43 -8
src/shared/infrastructure/http/app.ts
··· 1 - import express, { Express } from 'express'; 1 + import express, { Express, Request, Response, NextFunction } from 'express'; 2 2 import cors from 'cors'; 3 3 import cookieParser from 'cookie-parser'; 4 4 import { Router } from 'express'; ··· 50 50 } 51 51 }; 52 52 53 - app.use( 54 - cors({ 55 - origin: getAllowedOrigins(), 56 - methods: ['GET', 'POST', 'PUT', 'DELETE'], 57 - credentials: true, // Required for cookies to work in cross-origin requests 58 - }), 59 - ); 53 + const environment = configService.get().environment; 54 + const allowedOrigins = getAllowedOrigins(); 55 + const allowedMethods = ['GET', 'POST', 'PUT', 'DELETE']; 56 + 57 + if (environment === Environment.PROD) { 58 + app.use( 59 + cors({ 60 + origin: allowedOrigins, 61 + methods: allowedMethods, 62 + credentials: true, // Required for cookies to work in cross-origin requests 63 + }), 64 + ); 65 + } else { 66 + // DEV/LOCAL: allow credentialed CORS for known origins, open CORS for everyone else. 67 + // Non-allowed origins get '*' which browsers refuse to use with credentials — 68 + // so cookie-auth endpoints naturally fail for them, while read-only endpoints work. 69 + const allowedOriginsSet = new Set(allowedOrigins); 70 + app.use((req: Request, res: Response, next: NextFunction) => { 71 + const origin = req.headers.origin; 72 + 73 + if (typeof origin === 'string' && allowedOriginsSet.has(origin)) { 74 + res.setHeader('Access-Control-Allow-Origin', origin); 75 + res.setHeader('Access-Control-Allow-Credentials', 'true'); 76 + res.setHeader('Vary', 'Origin'); 77 + } else { 78 + res.setHeader('Access-Control-Allow-Origin', '*'); 79 + } 80 + 81 + res.setHeader('Access-Control-Allow-Methods', allowedMethods.join(',')); 82 + res.setHeader( 83 + 'Access-Control-Allow-Headers', 84 + 'Content-Type,Authorization', 85 + ); 86 + 87 + if (req.method === 'OPTIONS') { 88 + res.status(204).end(); 89 + return; 90 + } 91 + 92 + next(); 93 + }); 94 + } 60 95 61 96 // Middleware setup 62 97 app.use(cookieParser()); // Parse cookies from incoming requests