From 28e3ce922b1b601dd33a5e226afc6d11c054ece7 Mon Sep 17 00:00:00 2001 From: Scott Scoble Date: Sat, 2 May 2026 16:53:08 -0700 Subject: [PATCH] Fix CORS: lock to specific origins --- wardrobe-ai/backend/server.js | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/wardrobe-ai/backend/server.js b/wardrobe-ai/backend/server.js index af4ef85..7644f19 100644 --- a/wardrobe-ai/backend/server.js +++ b/wardrobe-ai/backend/server.js @@ -9,7 +9,11 @@ const PORT = process.env.PORT || 3001; app.use(express.json()); app.use(express.static(path.join(__dirname, '../frontend/public'))); app.use((req, res, next) => { - res.header('Access-Control-Allow-Origin', '*'); + const allowedOrigins = ['http://localhost:3000', 'https://wardrobeai.scoble.me']; + const origin = req.headers.origin; + if (allowedOrigins.includes(origin)) { + res.header('Access-Control-Allow-Origin', origin); + } res.header('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS'); res.header('Access-Control-Allow-Headers', 'Origin, X-Requested-With, Content-Type, Accept'); if (req.method === 'OPTIONS') {