1- /**
2- * CORS Configuration
3- */
1+ import { WHITELIST_DOMAINS } from '~/utils/constants'
2+ import { env } from '~/config/environment'
3+ import { StatusCodes } from 'http-status-codes'
4+ import ApiError from '~/utils/ApiError'
45
6+ // CORS Options Configuration
57export const corsOptions = {
6- origin : [
7- 'http://localhost:5173' , // Vite dev server
8- 'http://localhost:3000' , // React dev server alternative
9- 'http://127.0.0.1:5173' ,
10- 'http://127.0.0.1:3000'
11- ] ,
12- credentials : true , // Allow credentials (cookies, authorization headers, etc.)
13- methods : [ 'GET' , 'POST' , 'PUT' , 'DELETE' , 'PATCH' , 'OPTIONS' ] ,
14- allowedHeaders : [
15- 'Origin' ,
16- 'X-Requested-With' ,
17- 'Content-Type' ,
18- 'Accept' ,
19- 'Authorization' ,
20- 'Cache-Control'
21- ] ,
22- optionsSuccessStatus : 200 // Some legacy browsers (IE11, various SmartTVs) choke on 204
23- }
8+ origin : function ( origin , callback ) {
9+ // if origin is undefined in dev mode pass the CORS
10+ if ( env . BUILD_MODE === 'dev' ) {
11+ return callback ( null , true )
12+ }
13+
14+ // Check if the origin is in the whitelist
15+ if ( WHITELIST_DOMAINS . includes ( origin ) ) {
16+ return callback ( null , true )
17+ }
18+
19+ // If the domain is not allowed, return an error
20+ return callback ( new ApiError ( StatusCodes . FORBIDDEN , `${ origin } not allowed by our CORS Policy.` ) )
21+ } ,
22+ optionsSuccessStatus : 200 ,
23+
24+ // CORS will allow receiving cookies from requests
25+ credentials : true ,
26+ }
0 commit comments