fix: дополнительные настройки для CORS

.env.sample

@@ -1,6 +1,5 @@
 CLIENT_PORT=3000
 SERVER_PORT=3001
-SERVER_HOST='http://localhost'
 POSTGRES_USER=postgres
 POSTGRES_PASSWORD=postgres
 POSTGRES_DB=postgres
@@ -11,15 +10,21 @@ TRAEFIK_NETWORK_NAME=traefik_traefik
 DOCKER_BUILDKIT=1 #Build only stages required for target
 # **
 # If you want to use the production version
-# COMPOSE_FILE=docker-compose.yml
+COMPOSE_FILE=docker-compose.yml
+ALLOWED_ORIGINS=https://sokoly-tankwars-42.ya-praktikum.tech,http://sokoly-tankwars-42.ya-praktikum.tech:3001
+VITE_SERVER_HOST='https://sokoly-tankwars-42.ya-praktikum.tech'
 # **
 # **
-# If you want to use the develop version on windows
+# If you want to use the develop version
+# ALLOWED_ORIGINS=http://localhost:3001,http://sokoly-tankwars-42.ya-praktikum.tech:3001
+# VITE_SERVER_HOST='http://localhost:3001'
+# Compose on windows
 # COMPOSE_FILE=docker-compose.yml;docker-compose.dev.yml
 # **
 # If linux
-COMPOSE_FILE=docker-compose.yml:docker-compose.dev.yml
+# COMPOSE_FILE=docker-compose.yml:docker-compose.dev.yml
 VITE_AUTH_URL='https://ya-praktikum.tech/api/v2'
 VITE_SRC_URL='https://ya-praktikum.tech/api/v2/resources'
 VITE_AUTH_PATHNAMES='/sign-in, /sign-up'
-VITE_OAUTH_REDIRECTURL='http://sokoly-tankwars-42.ya-praktikum.tech:3001'
+VITE_OAUTH_REDIRECTURL='https://sokoly-tankwars-42.ya-praktikum.tech'
+

packages/client/nginx.conf

@@ -10,7 +10,20 @@ http {
         location / {
             root /app;
             try_files $uri /index.html;
-            add_header Access-Control-Allow-Origin *;
+        }
+
+        location /api/ {
+            proxy_pass http://localhost:3001;
+            proxy_set_header Host $host;
+
+            add_header Access-Control-Allow-Origin "http://localhost:3001" always;
+            add_header Access-Control-Allow-Credentials "true" always;
+            add_header Access-Control-Allow-Methods "GET, POST, OPTIONS, DELETE, PUT" always;
+            add_header Access-Control-Allow-Headers "Authorization, Content-Type" always;
+
+            if ($request_method = OPTIONS) {
+                return 204;
+            }
         }
     }
-}
+}

packages/client/src/api/localApi.ts

@@ -1,15 +1,11 @@
 import axios from 'axios'
-import dotenv from 'dotenv'
 
-dotenv.config()
+const host = import.meta.env.VITE_SERVER_HOST || 'http://localhost:3001'
 
-const port = process.env.SERVER_PORT || 3000
-const host = process.env.SERVER_HOST || 'http://localhost'
-
-console.log(`Local API: ${host}:${port}`)
+console.log(`Local API: ${host}`)
 
 const localApi = axios.create({
-  baseURL: `${host}:${port}`,
+  baseURL: `${host}`,
   headers: {
     'Content-Type': 'application/json',
   },

packages/server/index.ts

@@ -19,16 +19,25 @@ import topicRoutes from './routes/topic'
 
 dotenv.config()
 
+const allowedOrigins = process.env.ALLOWED_ORIGINS
+  ? process.env.ALLOWED_ORIGINS.split(',')
+  : ['http://localhost', 'http://localhost:3001']
+
 const port = process.env.SERVER_PORT || 3000
-const host = process.env.SERVER_HOST || 'http://localhost'
 const clientPath = path.join(__dirname, '../../client')
 const isDev = process.env.NODE_ENV === 'development'
 
 async function createServer() {
   const app = express()
   app.use(
     cors({
-      origin: `${host}:${port}`,
+      origin: (origin, callback) => {
+        if (!origin || allowedOrigins.includes(origin)) {
+          callback(null, true)
+        } else {
+          callback(new Error('Not allowed by CORS'))
+        }
+      },
       credentials: true,
     })
   )