Set CORS allow-origin to CLOUD_URL when API_URL is absolute

2026-05-12 23:08:56 -07:00
parent 3a78c4900d
commit bfb72a7890
1 changed files with 9 additions and 1 deletions
@@ -40,6 +40,8 @@ function normalizePath(url: string) {
 }

 const apiUrlOrigin = getUrlOrigin(apiUrl);
+const isAbsoluteApiUrl = Boolean(apiUrlOrigin);
+const allowOrigin = isAbsoluteApiUrl && cloudUrl ? cloudUrl : '*';
 const connectSrc = ["'self'", 'https:', apiUrlOrigin].filter(Boolean).join(' ');

 const contentSecurityPolicy = `
@@ -84,8 +86,14 @@ const trackerHeaders = [
 const apiHeaders = [
  {
    key: 'Access-Control-Allow-Origin',
-    value: '*',
+    value: allowOrigin,
  },
+  ...(allowOrigin !== '*'
+    ? [
+        { key: 'Access-Control-Allow-Credentials', value: 'true' },
+        { key: 'Vary', value: 'Origin' },
+      ]
+    : []),
  {
    key: 'Access-Control-Allow-Headers',
    value: '*',