packages/auth/src/auth.ts

@@ -39,6 +39,9 @@ export function createAuth(config: AuthConfig) {
       ]
     : undefined;
 
+  const corsOrigin = process.env['GATEWAY_CORS_ORIGIN'] ?? 'http://localhost:3000';
+  const trustedOrigins = corsOrigin.split(',').map((o) => o.trim());
+
   return betterAuth({
     database: drizzleAdapter(db, {
       provider: 'pg',
@@ -47,6 +50,7 @@ export function createAuth(config: AuthConfig) {
     baseURL: baseURL ?? process.env['BETTER_AUTH_URL'] ?? 'http://localhost:4000',
     secret: secret ?? process.env['BETTER_AUTH_SECRET'],
     basePath: '/api/auth',
+    trustedOrigins,
     emailAndPassword: {
       enabled: true,
     },