prod cors fix

BU-Spark · Oct 22, 2024 · f0738f6 · f0738f6
1 parent 8846451
commit f0738f6
Showing 1 changed file with 12 additions and 4 deletions.
diff --git a/backend/index.ts b/backend/index.ts
@@ -38,12 +38,20 @@ async function startServer() {
   // Apply necessary middlewares
 
 
-  app.use(cors({
-    origin: 'http://localhost:3000', // Allow requests from this origin
-    credentials: true,               // Allow credentials such as cookies or authorization headers
-    allowedHeaders: ['Content-Type', 'x-org-token', 'Authorization'], // Allow the custom header
+  const allowedOrigins = ['http://localhost:3000', 'https://bu-naacp.up.railway.app'];
 
+  app.use(cors({
+    origin: function (origin, callback) {
+      if (allowedOrigins.indexOf(origin) !== -1 || !origin) {
+        callback(null, true);
+      } else {
+        callback(new Error('Not allowed by CORS'));
+      }
+    },
+    credentials: true,
+    allowedHeaders: ['Content-Type', 'x-org-token', 'Authorization'], // Allow the custom headers
   }));
+
   // Connect to MongoDB
   const dbInstance = await connectWithMongoDB(mongo_url, dbName);