Bilder von Hand sortieren

backend/dist/app.js

@@ -27,28 +27,49 @@ const limiter = (0, express_rate_limit_1.default)({
     message: 'Too many requests from this IP, please try again later.',
 });
 app.use(limiter);
-const allowedOrigins = [
-    'http://localhost:5173',
-    'http://localhost:3000',
-    config_1.config.cors.origin
-].filter(Boolean);
-const corsConfig = config_1.config.cors.origin === '*'
-    ? {
-        origin: true,
-        credentials: true,
-    }
-    : {
-        origin: allowedOrigins,
-        credentials: true,
-    };
-app.use((0, cors_1.default)(corsConfig));
+const insecureOverride = process.env.ALLOW_INSECURE_CORS === '1';
+const isProd = process.env.NODE_ENV === 'production';
+let allowedOrigins = [];
+if (config_1.config.cors.origin.includes(',')) {
+    allowedOrigins = config_1.config.cors.origin.split(',').map(o => o.trim()).filter(Boolean);
+}
+else if (config_1.config.cors.origin === '*' && (!isProd || insecureOverride)) {
+    allowedOrigins = ['*'];
+}
+else {
+    allowedOrigins = [config_1.config.cors.origin];
+}
+allowedOrigins = Array.from(new Set(allowedOrigins.map(o => o.replace(/\/$/, ''))));
+if (!isProd && !allowedOrigins.includes('*')) {
+    ['http://localhost:5173', 'http://localhost:3000'].forEach(def => {
+        if (!allowedOrigins.includes(def))
+            allowedOrigins.push(def);
+    });
+}
+if (isProd && allowedOrigins.includes('*') && !insecureOverride) {
+    console.warn('[CORS] Wildcard removed in production. Set CORS_ORIGIN explicitly or ALLOW_INSECURE_CORS=1 (NOT RECOMMENDED).');
+    allowedOrigins = allowedOrigins.filter(o => o !== '*');
+}
+app.use((0, cors_1.default)({
+    origin: (origin, callback) => {
+        if (!origin)
+            return callback(null, true);
+        if (allowedOrigins.includes('*') || allowedOrigins.includes(origin.replace(/\/$/, ''))) {
+            return callback(null, true);
+        }
+        console.warn(`[CORS] Blocked origin: ${origin}`);
+        return callback(new Error('CORS not allowed for this origin'));
+    },
+    credentials: true,
+}));
 app.use((req, res, next) => {
     const origin = req.headers.origin;
-    if (config_1.config.cors.origin === '*') {
+    const normalized = origin?.replace(/\/$/, '');
+    if (allowedOrigins.includes('*')) {
         res.header('Access-Control-Allow-Origin', origin || '*');
     }
-    else if (origin && allowedOrigins.includes(origin)) {
-        res.header('Access-Control-Allow-Origin', origin);
+    else if (normalized && allowedOrigins.includes(normalized)) {
+        res.header('Access-Control-Allow-Origin', normalized);
     }
     res.header('Access-Control-Allow-Credentials', 'true');
     res.header('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS');
@@ -80,8 +101,12 @@ app.get('/serve/*', (req, res, next) => {
             resolvedPath: fullPath
         });
     }
+    const requestOrigin = req.headers.origin;
+    const chosenOrigin = allowedOrigins.includes('*')
+        ? (requestOrigin || '*')
+        : (requestOrigin && allowedOrigins.includes(requestOrigin) ? requestOrigin : allowedOrigins[0] || 'http://localhost:3000');
     res.set({
-        'Access-Control-Allow-Origin': 'http://localhost:5173',
+        'Access-Control-Allow-Origin': chosenOrigin,
         'Access-Control-Allow-Credentials': 'true',
         'Cache-Control': 'public, max-age=31536000',
     });