fix: allow origin to be only the same - fix #223

openhotel · Dec 14, 2024 · b7649b2 · b7649b2
1 parent c9db168
commit b7649b2
Showing 1 changed file with 8 additions and 1 deletion.
diff --git a/app/server/src/modules/system/api.ts b/app/server/src/modules/system/api.ts
@@ -34,11 +34,14 @@ export const api = () => {
 
         try {
           const { url, method } = request;
-          if (method === RequestMethod.OPTIONS)
+          if (method === RequestMethod.OPTIONS) {
+            const headers = getCORSHeaders() as Headers;
+            headers.set("Access-Control-Allow-Origin", System.getConfig().url);
             return new Response(null, {
               headers: getCORSHeaders(),
               status: 204,
             });
+          }
 
           const parsedUrl = new URL(url);
 
@@ -76,6 +79,10 @@ export const api = () => {
           if (foundMethodRequest) {
             const response = await foundMethodRequest.func(request, parsedUrl);
             appendCORSHeaders(response.headers);
+            response.headers.set(
+              "Access-Control-Allow-Origin",
+              System.getConfig().url,
+            );
             return response;
           }
           if (foundRequests.length)