From 537f94041ffc3ddbe853ca3ae604f24a1ff1e7e3 Mon Sep 17 00:00:00 2001 From: Inamul-hasan-tec Date: Thu, 20 Aug 2026 11:44:37 +0530 Subject: [PATCH] fix(cors): allow X-Impersonated-Tenant-Id and dynamic origin in app.js --- app.js | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/app.js b/app.js index 02fbd44..0e05e15 100644 --- a/app.js +++ b/app.js @@ -17,10 +17,12 @@ app.use(helmet({ crossOriginResourcePolicy: { policy: 'cross-origin' }, })); app.use(cors({ - origin: process.env.CORS_ORIGIN ? (process.env.CORS_ORIGIN.includes(',') ? process.env.CORS_ORIGIN.split(',') : process.env.CORS_ORIGIN) : '*', + origin: true, + credentials: true, methods: ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS', 'PATCH'], - allowedHeaders: ['Content-Type', 'Authorization', 'Accept', 'X-Requested-With'] + allowedHeaders: ['Content-Type', 'Authorization', 'Accept', 'X-Requested-With', 'x-tenant-id', 'x-impersonated-tenant-id', 'X-Tenant-Id', 'X-Impersonated-Tenant-Id', 'x-api-key', 'X-Api-Key', '*'] })); +app.options('*', cors()); app.use(compression()); app.use(cookieParser()); app.use(express.json());