Merge pull request #306 from StampyAI/cors

Allow localhost for CORS
StampyAI · Aug 25, 2023 · dd69523 · dd69523
2 parents 402807c + 4690fcf
commit dd69523
Showing 1 changed file with 16 additions and 4 deletions.
diff --git a/app/server-utils/responses.ts b/app/server-utils/responses.ts
@@ -8,16 +8,28 @@ export const jsonCORS = <T>(data: T) =>
     },
   })
 
-export const CORSOptions = (request: Request) => {
+const allowedOrigins = (request: Request) => {
   const origin = request.headers.get('origin') || ''
-  const isOriginAllowed = ALLOW_ORIGINS == '*' || ALLOW_ORIGINS.split(',').includes(origin)
-  const allowed = isOriginAllowed ? origin : ''
+  const allowedOrigins = ALLOW_ORIGINS.split(',')
+
+  // always allow localhost
+  try {
+    if (['localhost', '127.0.0.1'].includes(new URL(origin).hostname)) {
+      return origin
+    }
+  } catch (e) {
+    // ignore errors
+  }
 
+  return ALLOW_ORIGINS == '*' || allowedOrigins.includes(origin) ? origin : ''
+}
+
+export const CORSOptions = (request: Request) => {
   return json(
     {},
     {
       headers: {
-        'Access-Control-Allow-Origin': allowed,
+        'Access-Control-Allow-Origin': allowedOrigins(request),
         'Access-Control-Allow-Methods': 'GET, POST, PUT, DELETE',
         'Access-Control-Allow-Headers': 'Content-Type, Authorization, allow-control-allow-origin',
       },