From 3b9913febafe1db12e1a43235b649fa841818497 Mon Sep 17 00:00:00 2001
From: ReLoia <zrennyz@gmail.com>
Date: Wed, 10 Jun 2026 12:51:48 +0200
Subject: [PATCH] update CORS configuration to support multiple allowed origins

---
 common/Cors.cc | 76 ++++++++++++++++++++++++++++++++++++++++++++------
 config.json    |  4 +--
 2 files changed, 69 insertions(+), 11 deletions(-)

diff --git a/common/Cors.cc b/common/Cors.cc
index 6d1fc33..45881c5 100644
--- a/common/Cors.cc
+++ b/common/Cors.cc
@@ -6,33 +6,91 @@ namespace visione::cors
 {
 namespace
 {
-std::string allowedOrigin()
+std::vector<std::string> allowedOrigins()
 {
-    return drogon::app()
-        .getCustomConfig()["cors"]
-        .get("allowed_origin", "http://localhost:5173")
-        .asString();
+    auto cfg = drogon::app().getCustomConfig();
+    std::vector<std::string> origins;
+
+    if (cfg.isMember("cors") && cfg["cors"].isObject())
+    {
+        auto &c = cfg["cors"];
+        if (c.isMember("allowed_origin"))
+        {
+            auto &v = c["allowed_origin"];
+            if (v.isArray())
+            {
+                for (const auto &el : v)
+                {
+                    if (el.isString())
+                        origins.emplace_back(el.asString());
+                }
+            }
+            else if (v.isString())
+            {
+                origins.emplace_back(v.asString());
+            }
+        }
+    }
+
+    if (origins.empty())
+        origins.emplace_back("http://localhost:5173");
+
+    return origins;
 }
 
 bool isAllowed(const drogon::HttpRequestPtr &request)
 {
-    return request->getHeader("Origin") == allowedOrigin();
+    auto origin = request->getHeader("Origin");
+    if (origin.empty())
+        return false;
+
+    auto origins = allowedOrigins();
+    for (const auto &o : origins)
+    {
+        if (o == "*" || o == origin)
+            return true;
+    }
+    return false;
 }
 
 void addHeaders(const drogon::HttpRequestPtr &request,
                 const drogon::HttpResponsePtr &response)
 {
-    if (!isAllowed(request))
-    {
+    auto origin = request->getHeader("Origin");
+    if (origin.empty())
         return;
+
+    auto origins = allowedOrigins();
+    bool allowAll = false;
+    bool matched = false;
+    for (const auto &o : origins)
+    {
+        if (o == "*")
+        {
+            allowAll = true;
+            break;
+        }
+        if (o == origin)
+        {
+            matched = true;
+            break;
+        }
     }
 
-    response->addHeader("Access-Control-Allow-Origin", allowedOrigin());
+    if (!allowAll && !matched)
+        return;
+
+    if (allowAll)
+        response->addHeader("Access-Control-Allow-Origin", "*");
+    else
+        response->addHeader("Access-Control-Allow-Origin", origin);
+
     response->addHeader("Access-Control-Allow-Credentials", "true");
     response->addHeader("Access-Control-Allow-Methods",
                         "GET,POST,PATCH,DELETE,OPTIONS");
     response->addHeader("Access-Control-Allow-Headers",
                         "Authorization,Content-Type");
+    response->addHeader("Vary", "Origin");
 }
 }  // namespace
 
diff --git a/config.json b/config.json
index 66782bc..e7bfd4d 100644
--- a/config.json
+++ b/config.json
@@ -63,7 +63,7 @@
       "spec_path": "build/openapi/visione.openapi.json"
     },
     "cors": {
-      "allowed_origin": "http://localhost:5173"
+      "allowed_origin": ["http://localhost:3000", "http://localhost:5137"]
     }
   }
-}
+}
\ No newline at end of file