u

src/api/index.js

@@ -46,6 +46,20 @@ let httpsServer;
 let starting;
 let startedAt;
 
+function isAllowedOrigin(origin) {
+    if (!origin) return false;
+    if (env.corsOrigins.includes(origin)) return true;
+    try {
+        const u = new URL(origin);
+        if (u.hostname === 'quixpos.com' || u.hostname.endsWith('.quixpos.com')) {
+            return true;
+        }
+    } catch {
+        // ignore invalid URL
+    }
+    return false;
+}
+
 function corsMiddleware(req, res, next) {
     const origin = req.headers.origin;
 
@@ -59,11 +73,15 @@ function corsMiddleware(req, res, next) {
         return next();
     }
 
-    if (origin && env.corsOrigins.includes(origin)) {
+    if (origin && isAllowedOrigin(origin)) {
         res.setHeader('Access-Control-Allow-Origin', origin);
         res.setHeader('Vary', 'Origin');
         res.setHeader('Access-Control-Allow-Credentials', 'true');
-        res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization');
+        const reqHeaders = req.headers['access-control-request-headers'];
+        res.setHeader(
+            'Access-Control-Allow-Headers',
+            reqHeaders || 'Content-Type, Authorization, x-auth-token, authtoken, auth-token, token, x-token'
+        );
         res.setHeader('Access-Control-Allow-Methods', 'GET,POST,PUT,PATCH,DELETE,OPTIONS');
     }