Potential fix for code scanning alert no. 58: CORS misconfiguration for credentials transfer

[utsavjosh1]

Potential fix for https://github.com/utsavjosh1/Postly/security/code-scanning/58

To fix this safely, keep the allowlist logic but stop writing the raw request header back to Access-Control-Allow-Origin. Instead:

• Normalize and validate the request origin.
• Explicitly reject "null".
• Find an exact match in the normalized trusted origins list.
• Set Access-Control-Allow-Origin to the trusted matched value (server-side canonical value), not origin.

In apps/api/src/middleware/error-handler.ts, update the CORS block around lines 23–36:

• Build allowedOrigins as normalized values.
• Ensure normalizedOrigin !== "null".
• Use const matchedOrigin = allowedOrigins.find((o) => o === normalizedOrigin);
• If matched, set header with matchedOrigin instead of origin as string.

No new imports or dependencies are required.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
postly-web	Ready	Preview, Comment	Apr 28, 2026 5:33pm