Allow local frontend CORS origins

.env.example

@@ -1,4 +1,4 @@
 DATABASE_URL="postgresql://postgres:postgres@localhost:5432/mtc_reverse_proxy?schema=public"
 PORT=4000
-FRONTEND_ORIGIN="http://localhost:5173"
+FRONTEND_ORIGINS="http://localhost:5173,http://127.0.0.1:5173"
 REVERSE_PROXY_TIMEOUT_MS=15000

src/server.js

@@ -6,10 +6,20 @@ const routes = require("./routes");
 
 const app = express();
 const port = Number(process.env.PORT || 4000);
+const allowedOrigins = (process.env.FRONTEND_ORIGINS || process.env.FRONTEND_ORIGIN || "http://localhost:5173,http://127.0.0.1:5173")
+  .split(",")
+  .map((origin) => origin.trim())
+  .filter(Boolean);
 
 app.use(
   cors({
-    origin: process.env.FRONTEND_ORIGIN || "http://localhost:5173",
+    origin(origin, callback) {
+      if (!origin || allowedOrigins.includes(origin)) {
+        callback(null, true);
+        return;
+      }
+      callback(new Error(`CORS origin not allowed: ${origin}`));
+    },
   }),
 );
 app.use(express.json({ limit: "2mb" }));