mosaic/stack
1
0
Fork 0
Code Issues 10 Pull Requests Actions Packages Projects Releases 2 Wiki Activity

fix(api): use getTrustedOrigins() for WebSocket CORS #549

Merged
jason.woltje merged 1 commits from fix/websocket-cors-origins into main 2026-02-27 12:07:52 +00:00
Conversation 0 Commits 1 Files Changed 1 +2 -1

1 Commits

Author SHA1 Message Date
Jason Woltje
ac2a92d371 fix(api): use getTrustedOrigins() for WebSocket CORS instead of WEB_URL
All checks were successful
ci/woodpecker/push/api Pipeline was successful
Details 
The WebSocket gateway was hardcoded to `process.env.WEB_URL ?? "http://localhost:3000"`
for CORS origin, while the main API uses getTrustedOrigins() which reads TRUSTED_ORIGINS.
In production, WEB_URL was not set, causing CORS to reject connections from
mosaic.woltje.com with "Access-Control-Allow-Origin: http://localhost:3000".

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-02-27 06:04:40 -06:00