Repository navigation
fix: read http-server CORS origin from CORS_ORIGIN - #217
Merged
TheCodeHeist-Coder merged 1 commit intoOct 26, 2026
Merged
TheCodeHeist-Coder merged 1 commit into
TheCodeHeist-Coder merged 1 commit into
Conversation
The origin was hard-coded to https://rexial.in, so the frontend on localhost:5173 got blocked in local dev. It now comes from a comma-separated CORS_ORIGIN env var and defaults to http://localhost:5173, same as apps/streaming. Production needs CORS_ORIGIN=https://rexial.in in .env.prod.
TheCodeHeist-Coder
self-requested a review
October 26, 2026 12:46
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
The http-server had
cors({ origin: 'https://rexial.in' })hard-coded, so the frontend onlocalhost:5173got blocked by CORS in local dev. It now reads the allowed origins from aCORS_ORIGINenv var (comma separated) and falls back tohttp://localhost:5173when it is not set, same pattern asapps/streaming/src/config.ts.I also added
CORS_ORIGINto the http-server.envexample insetup.mdandCONTRIBUTING.md.Production needs
CORS_ORIGIN=https://rexial.inset before this is deployed..env.prodis gitignored so I could not add it myself. If it is missing, the server will only allowhttp://localhost:5173and the live site will get CORS errors.Related issue
Closes #212
Type of change
Which services does this touch?
apps/frontendapps/http-serverapps/ws-serverapps/genAIpackages/db(schema or Prisma changes)How did you test this?
Built http-server (
pnpm --filter http-server build, passes) and startednode dist/index.json a few ports. It starts fine without a database running. Then sent the preflight from the issue with curl:curl -i -X OPTIONS localhost:<port>/api/v1/auth/login -H "Origin: <origin>" -H "Access-Control-Request-Method: POST" -H "Access-Control-Request-Headers: content-type"CORS_ORIGINunset:http://localhost:5173getsAccess-Control-Allow-Origin: http://localhost:5173.CORS_ORIGIN=https://rexial.in:https://rexial.inis still allowed.http://localhost:5173andhttps://evil.exampleget noAccess-Control-Allow-Originheader.CORS_ORIGIN="https://rexial.in, http://localhost:5173": both are allowed,https://evil.exampleis not.I did not run it with the full docker compose stack or the real frontend in a browser.
Checklist
pnpm run lintpnpm run check-typespnpm run builddocker-compose up.envfile, API key or other secretpnpm run lintfails on main already, inapps/frontend(a bunch ofno-explicit-anyerrors in files I did not touch), so I left that box unticked.pnpm run check-typespasses, but http-server has nocheck-typesscript so it only covers other packages;tsc -bin the http-server build is what type-checked my change. I only ran the http-server build, not the fullpnpm run build.First pull request here? CONTRIBUTING.md walks through the
whole process, and a checkbox left unticked is not a problem — say so and we
will help.