fix(cors): allow X-Impersonated-Tenant-Id and dynamic origin in app.js

2026-08-20 11:44:37 +05:30
parent 70ce1b9efe
commit 537f94041f
1 changed files with 4 additions and 2 deletions
@@ -17,10 +17,12 @@ app.use(helmet({
  crossOriginResourcePolicy: { policy: 'cross-origin' },
 }));
 app.use(cors({
-  origin: process.env.CORS_ORIGIN ? (process.env.CORS_ORIGIN.includes(',') ? process.env.CORS_ORIGIN.split(',') : process.env.CORS_ORIGIN) : '*',
+  origin: true,
+  credentials: true,
  methods: ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS', 'PATCH'],
-  allowedHeaders: ['Content-Type', 'Authorization', 'Accept', 'X-Requested-With']
+  allowedHeaders: ['Content-Type', 'Authorization', 'Accept', 'X-Requested-With', 'x-tenant-id', 'x-impersonated-tenant-id', 'X-Tenant-Id', 'X-Impersonated-Tenant-Id', 'x-api-key', 'X-Api-Key', '*']
 }));
+app.options('*', cors());
 app.use(compression());
 app.use(cookieParser());
 app.use(express.json());