allow localhost on dev api

Author: YaoxuanZhang

internal/config/config.go

@@ -16,7 +16,7 @@ type Config struct {
 type ServerConfig struct {
 	Host           string   `env:"SERVER_HOST" env-default:"0.0.0.0"`
 	Port           string   `env:"SERVER_PORT" env-default:"8080"`
-	AllowedOrigins []string `env:"ALLOWED_ORIGINS" env-default:"http://localhost:3000,http://localhost:8080" env-separator:","`
+	AllowedOrigins []string `env:"ALLOWED_ORIGINS" env-default:"http://localhost:3000,http://localhost:8080,http://localhost:5173,http://127.0.0.1:3000,http://127.0.0.1:8080,http://127.0.0.1:5173" env-separator:","`
 }
 
 type DatabaseConfig struct {

internal/middleware/cors.go

@@ -1,26 +1,40 @@
 package middleware
 
-import "net/http"
+import (
+	"net/http"
+	"strings"
+)
 
 // CORS adds CORS headers for cross-origin requests
-func CORS(allowedOrigins []string) func(http.Handler) http.Handler {
+func CORS(allowedOrigins []string, isDev bool) func(http.Handler) http.Handler {
 	return func(next http.Handler) http.Handler {
 		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 			origin := r.Header.Get("Origin")
 			allowed := false
 
-			// Allow if origin is in allowlist
-			for _, o := range allowedOrigins {
-				if o == origin {
-					allowed = true
-					break
+			// In development, allow any localhost or 127.0.0.1 origin
+			isLocal := strings.HasPrefix(origin, "http://localhost") || strings.HasPrefix(origin, "http://127.0.0.1")
+			if isDev && isLocal {
+				allowed = true
+			}
+
+			// In production, explicitly block localhost/127.0.0.1 even if in allowlist
+			if !isDev && isLocal {
+				allowed = false
+			} else if !allowed {
+				// Allow if origin is in allowlist
+				for _, o := range allowedOrigins {
+					if o == origin {
+						allowed = true
+						break
+					}
 				}
 			}
 
 			// If no allowed origins specified, allow all (development mode)
 			// But for credentials to work with *, strict browsers block it.
 			// So good practice: if development, echo back origin.
-			if len(allowedOrigins) == 0 {
+			if !allowed && len(allowedOrigins) == 0 {
 				allowed = true
 			}
 

internal/middleware/cors_test.go

@@ -17,6 +17,7 @@ func TestCORS(t *testing.T) {
 		origin         string
 		method         string
 		setupOrigins   []string
+		isDev          bool
 		expectedOrigin string
 		expectedCreds  string
 	}{
@@ -25,6 +26,7 @@ func TestCORS(t *testing.T) {
 			origin:         "https://app.example.com",
 			method:         "GET",
 			setupOrigins:   allowedOrigins,
+			isDev:          false,
 			expectedOrigin: "https://app.example.com",
 			expectedCreds:  "true",
 		},
@@ -33,6 +35,7 @@ func TestCORS(t *testing.T) {
 			origin:         "https://evil.com",
 			method:         "GET",
 			setupOrigins:   allowedOrigins,
+			isDev:          false,
 			expectedOrigin: "",
 			expectedCreds:  "",
 		},
@@ -41,6 +44,7 @@ func TestCORS(t *testing.T) {
 			origin:         "",
 			method:         "GET",
 			setupOrigins:   allowedOrigins,
+			isDev:          false,
 			expectedOrigin: "",
 			expectedCreds:  "",
 		},
@@ -49,6 +53,7 @@ func TestCORS(t *testing.T) {
 			origin:         "https://app.example.com",
 			method:         "OPTIONS",
 			setupOrigins:   allowedOrigins,
+			isDev:          false,
 			expectedOrigin: "https://app.example.com",
 			expectedCreds:  "true",
 		},
@@ -57,14 +62,33 @@ func TestCORS(t *testing.T) {
 			origin:         "https://random.com",
 			method:         "GET",
 			setupOrigins:   []string{}, // Empty = allow all
+			isDev:          false,      // Though typically true in dev
 			expectedOrigin: "https://random.com",
 			expectedCreds:  "true",
 		},
+		{
+			name:           "AllowedLocalhostInDev",
+			origin:         "http://localhost:5173",
+			method:         "GET",
+			setupOrigins:   []string{"https://app.example.com"},
+			isDev:          true,
+			expectedOrigin: "http://localhost:5173",
+			expectedCreds:  "true",
+		},
+		{
+			name:           "BlockedLocalhostInProd",
+			origin:         "http://localhost:3000",
+			method:         "GET",
+			setupOrigins:   []string{"http://localhost:3000", "https://app.example.com"},
+			isDev:          false,
+			expectedOrigin: "",
+			expectedCreds:  "",
+		},
 	}
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			handler := middleware.CORS(tt.setupOrigins)(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			handler := middleware.CORS(tt.setupOrigins, tt.isDev)(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 				w.WriteHeader(http.StatusOK)
 			}))
 

internal/router/router.go

@@ -20,7 +20,7 @@ func New(h *handler.Handler, queries database.Querier, jwtSecret string, allowed
 	}
 	r.Use(chimiddleware.Recoverer)
 	r.Use(chimiddleware.RequestID)
-	r.Use(middleware.CORS(allowedOrigins))
+	r.Use(middleware.CORS(allowedOrigins, h.Config.Env == "development"))
 
 	// API routes
 	r.Route("/api", func(r chi.Router) {