From 329f5b80df1ea554b9c3f030c99e84e75555d01a Mon Sep 17 00:00:00 2001 From: hsiegeln <37154749+hsiegeln@users.noreply.github.com> Date: Mon, 6 Apr 2026 00:40:00 +0200 Subject: [PATCH] feat: add CORS allowed origins for server behind reverse proxy Browser sends Origin header on fetch calls even same-origin. Server needs the public host in its CORS allowlist. Derived from PUBLIC_HOST. Co-Authored-By: Claude Opus 4.6 (1M context) --- docker-compose.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/docker-compose.yml b/docker-compose.yml index 9b446c9..7493312 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -171,6 +171,7 @@ services: CAMELEER_OIDC_JWK_SET_URI: ${LOGTO_ENDPOINT:-http://logto:3001}/oidc/jwks CAMELEER_OIDC_TLS_SKIP_VERIFY: "true" CAMELEER_OIDC_AUDIENCE: ${CAMELEER_OIDC_AUDIENCE:-https://api.cameleer.local} + CAMELEER_CORS_ALLOWED_ORIGINS: ${PUBLIC_PROTOCOL:-https}://${PUBLIC_HOST:-localhost} healthcheck: test: ["CMD-SHELL", "curl -sf http://localhost:8081/api/v1/health || exit 1"] interval: 5s