From 9abc09c2a69a254a649cb98449c3b22d373451bd Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Thu, 30 Jul 2026 08:16:28 +0000 Subject: [PATCH] fix(core-backend): enable CORS for Flutter Web signup Chrome treats localhost:5555 and 127.0.0.1:8080 as different origins. Handle OPTIONS preflight and emit Access-Control-Allow-* so /auth/signup works from flutter run -d chrome. Co-authored-by: okuma --- core-backend/main.go | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/core-backend/main.go b/core-backend/main.go index 58d08d6..fc86e7c 100644 --- a/core-backend/main.go +++ b/core-backend/main.go @@ -49,8 +49,32 @@ type draftMessageRequest struct { K int `json:"k"` } +// corsMiddleware allows Flutter Web (and other local origins) to call the API. +// Browsers treat http://localhost:5555 and http://127.0.0.1:8080 as different +// origins, so Chrome signup fails without OPTIONS + Allow-Origin headers. +func corsMiddleware() gin.HandlerFunc { + return func(c *gin.Context) { + origin := c.GetHeader("Origin") + if origin == "" { + origin = "*" + } + c.Header("Access-Control-Allow-Origin", origin) + c.Header("Vary", "Origin") + c.Header("Access-Control-Allow-Credentials", "true") + c.Header("Access-Control-Allow-Headers", "Content-Type, Authorization, X-Requested-With") + c.Header("Access-Control-Allow-Methods", "GET, POST, PUT, PATCH, DELETE, OPTIONS") + c.Header("Access-Control-Max-Age", "600") + if c.Request.Method == http.MethodOptions { + c.AbortWithStatus(http.StatusNoContent) + return + } + c.Next() + } +} + func setupRouter(db *gorm.DB, relay *ConnectionManager, ai *AIServiceClient) *gin.Engine { r := gin.Default() + r.Use(corsMiddleware()) r.GET("/health", func(c *gin.Context) { c.JSON(http.StatusOK, gin.H{"status": "ok"})