From 43040b2ac856d43b28a6f3ddf4b95275d1637f5d Mon Sep 17 00:00:00 2001
From: space <space@reversed.dev>
Date: Sat, 1 Aug 2026 00:53:56 +0200
Subject: [PATCH] Allowed "*" as a CORS_DOMAINS entry which overrides the cors
 middleware

---
 Backend/src/index.ts                |  9 ++++++++-
 Backend/src/lib/middlewares/cors.ts | 20 ++++++++++++++++++++
 2 files changed, 28 insertions(+), 1 deletion(-)

diff --git a/Backend/src/index.ts b/Backend/src/index.ts
index a9e9767..85482d0 100644
--- a/Backend/src/index.ts
+++ b/Backend/src/index.ts
@@ -29,9 +29,16 @@ export const PORT = env.PORT;
 
 export { prisma };
 
-const CORS_DOMAINS = env.CORS_URLS.split(",").map((s) => s.trim());
+let CORS_DOMAINS = env.CORS_URLS.split(",").map((s) => s.trim());
 CORS_DOMAINS.push(UI_URL);
 CORS_DOMAINS.push(REACT_APP_API_URL.replace(/\/+$/, ""));
+
+// If an origin is "*", clear the list and add a star
+// ? This is for PR-Previews especially, which have a dynamic origin and cannot be enumerated in advance
+if (CORS_DOMAINS.includes("*")) {
+	CORS_DOMAINS = ["*"];
+}
+
 initCorsDomains(CORS_DOMAINS);
 
 if (env.NODE_ENV !== "test") {
diff --git a/Backend/src/lib/middlewares/cors.ts b/Backend/src/lib/middlewares/cors.ts
index c39657f..a5cea5f 100644
--- a/Backend/src/lib/middlewares/cors.ts
+++ b/Backend/src/lib/middlewares/cors.ts
@@ -29,6 +29,26 @@ export const corsMiddleware = new Middleware<{}, {}>("Custom CORS", "1.0.0")
 
 		const origin = ctr.headers.get("origin");
 
+		// if the list is only a single star, allow all origins
+		if (CORS_DOMAINS.length === 1 && CORS_DOMAINS[0] === "*") {
+			if (origin) {
+				ctr.headers.set("Access-Control-Allow-Origin", origin);
+				ctr.headers.set("Vary", "Origin");
+				ctr.headers.set("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS, PATCH");
+				ctr.headers.set(
+					"Access-Control-Allow-Headers",
+					ctr.headers.get("access-control-request-headers") || "content-type, x-api-key",
+				);
+				ctr.headers.set("Access-Control-Allow-Credentials", "true");
+			}
+			if (ctr.url.method === "OPTIONS") {
+				ctr.headers.set("Access-Control-Max-Age", "86400");
+				ctr.headers.set("Content-Length", "0");
+				return end(ctr.status(ctr.$status.NO_CONTENT).print(""));
+			}
+			return;
+		}
+
 		if (origin && !CORS_DOMAINS.includes(origin)) {
 			// Agent/API traffic (no browser origin) is unaffected; only browser
 			// requests from disallowed origins are blocked.