diff --git a/src/main.ts b/src/main.ts index 72a04ff..1198444 100644 --- a/src/main.ts +++ b/src/main.ts @@ -37,40 +37,44 @@ async function bootstrap() { const configService = app.get(ConfigService); - const origins = configService.get('app.corsOrigins'); - const subdomain = configService.get('app.corsSubdomain'); - - console.log(subdomain, origins); - app.enableCors({ - origin: (origin: string, callback: any) => { - if (!origin) { - // eslint-disable-next-line @typescript-eslint/no-unsafe-return, @typescript-eslint/no-unsafe-call - return callback(null, true); - } - - if (origins?.includes(origin)) { - // eslint-disable-next-line @typescript-eslint/no-unsafe-return, @typescript-eslint/no-unsafe-call - return callback(null, true); - } - - try { - const hostname = new URL(origin).hostname; - - if (hostname === subdomain || hostname.endsWith(`.${subdomain}`)) { - // eslint-disable-next-line @typescript-eslint/no-unsafe-return, @typescript-eslint/no-unsafe-call - return callback(null, true); - } - } catch { - /* empty */ - } - - // eslint-disable-next-line @typescript-eslint/no-unsafe-call - callback(new Error('Not allowed by CORS')); - }, + origin: true, credentials: true, }); + // TODO: Uncomment + // const origins = configService.get('app.corsOrigins'); + // const subdomain = configService.get('app.corsSubdomain'); + + // app.enableCors({ + // origin: (origin: string, callback: any) => { + // if (!origin) { + // // eslint-disable-next-line @typescript-eslint/no-unsafe-return, @typescript-eslint/no-unsafe-call + // return callback(null, true); + // } + + // if (origins?.includes(origin)) { + // // eslint-disable-next-line @typescript-eslint/no-unsafe-return, @typescript-eslint/no-unsafe-call + // return callback(null, true); + // } + + // try { + // const hostname = new URL(origin).hostname; + + // if (hostname === subdomain || hostname.endsWith(`.${subdomain}`)) { + // // eslint-disable-next-line @typescript-eslint/no-unsafe-return, @typescript-eslint/no-unsafe-call + // return callback(null, true); + // } + // } catch { + // /* empty */ + // } + + // // eslint-disable-next-line @typescript-eslint/no-unsafe-call + // callback(new Error('Not allowed by CORS')); + // }, + // credentials: true, + // }); + app.use(helmet()); const config = new DocumentBuilder()