fix(api): use getTrustedOrigins() for WebSocket CORS #549

jason.woltje · 2026-02-27T12:05:06Z

jason.woltje commented

2026-02-27 12:05:06 +00:00

WebSocket gateway CORS was hardcoded to localhost:3000 via WEB_URL fallback. Production doesn't set WEB_URL, causing CORS rejections for mosaic.woltje.com. Now uses getTrustedOrigins() matching the main API CORS config.

jason.woltje added 1 commit 2026-02-27 12:05:06 +00:00

fix(api): use getTrustedOrigins() for WebSocket CORS instead of WEB_URL

ci/woodpecker/push/api Pipeline was successful

Details

ac2a92d371

The WebSocket gateway was hardcoded to `process.env.WEB_URL ?? "http://localhost:3000"`
for CORS origin, while the main API uses getTrustedOrigins() which reads TRUSTED_ORIGINS.
In production, WEB_URL was not set, causing CORS to reject connections from
mosaic.woltje.com with "Access-Control-Allow-Origin: http://localhost:3000".

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

jason.woltje merged commit 78b643a945 into main

2026-02-27 12:07:52 +00:00

jason.woltje referenced this issue from a commit

2026-02-27 12:07:54 +00:00

fix(api): use getTrustedOrigins() for WebSocket CORS (#549)

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: mosaic/stack#549