kennethscoffee/starr-philproperties
1
0
Fork 0
mirror of https://github.com/rgrgogu/new_starr.git synced 2026-09-27 00:12:54 +08:00
Code Issues Packages Projects Releases Wiki Activity

token issues more for pdf preview missing

Browse Source 
With DEV to QAS live test environment

Signed-off-by: Kenneth Obsequio <k80308392@gmail.com>
This commit is contained in:
kennethobsequio
2026-08-05 20:43:16 +08:00
parent 0c7f5ccd0f
commit 141b7ab592
5 changed files with 170 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files
controllers/client/media.controller.js
+11 -2
View File
@@ -218,8 +218,17 @@ exports.streamAsset = async (req, res) => {
const { token } = req.params;
// ── CORS ──────────────────────────────────────────────────────────────────
const allowedOrigin = process.env.FRONTEND_URL ?? "http://localhost:5173";
res.setHeader("Access-Control-Allow-Origin", allowedOrigin);
// Mirrors server.js's global cors() origin check (reflect against
// ALLOWED_ORIGINS) instead of a single hardcoded FRONTEND_URL — a static
// origin here silently overwrote the correct header the global middleware
// already set, breaking any CORS-checked read (e.g. pdf.js's Range-header
// fetch) whenever FRONTEND_URL drifted from the deployed frontend domain.
// <img>/<video> tags were unaffected since opaque loads skip CORS checks.
const allowedOrigins = (process.env.ALLOWED_ORIGINS || process.env.APP_URL || "*").split(",");
const requestOrigin = req.headers.origin;
if (requestOrigin && allowedOrigins.includes(requestOrigin)) {
res.setHeader("Access-Control-Allow-Origin", requestOrigin);
}
res.setHeader("Access-Control-Allow-Credentials", "true");
res.setHeader("Access-Control-Allow-Methods", "GET, OPTIONS");
res.setHeader("Access-Control-Allow-Headers", "Range, Authorization");