danvics/pediatric-ai-scribe-v3
1
0
Fork 0
Code Issues Pull requests Projects Releases 14 Packages Wiki Activity Actions

fix: scope CORS middleware to /api so static assets aren't rejected

Browse source 
ES module script tags (<script type="module">) always send an Origin
header on fetch, even for same-origin requests. The global cors()
middleware was rejecting /js/bedside/index.js with 500 in the e2e
harness because the container's internal origin
(http://pediatric-ai-scribe:3000) is not in APP_URL/CORS_ORIGINS.

Production was unaffected (real users hit APP_URL, which is allowed),
but the fix is architecturally correct either way: CORS belongs on
the API boundary, not on static file serving. All protected routes
are under /api/*.

Unblocks the bedside smoke suite — now 26/26 green.
This commit is contained in:
Daniel 2026-04-20 22:30:52 +02:00
parent ddf9ca805b
commit f5f2f09659
1 changed files with 3 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
server.js
View file

@ -64,7 +64,9 @@ if (IS_PROD && allowedOrigins.length === 0) {
console.error('[FATAL] Production mode but no APP_URL or CORS_ORIGINS set. Refusing to run with open CORS.');
process.exit(1);
}
app.use(cors({
// Scoped to /api only — static assets (including type="module" scripts which
// always send an Origin header) must not be subject to CORS checks.
app.use('/api', cors({
origin: function(origin, callback) {
// Allow requests with no origin (mobile apps, curl, server-to-server)
if (!origin) return callback(null, true);