e11c9ab58b
The same-origin check compared the browser's Origin header against new URL(request.url), but inside the Planner container request.url is http://planner:3001/... while the browser sends Origin https://planner.trails.cool — so production always 403'd. Trust Caddy's X-Forwarded-Host and X-Forwarded-Proto headers when present (both are set by Caddy's reverse_proxy directive by default) to reconstruct the external origin the browser actually connected to. Falls back to request.url for dev and any direct (non-proxied) access. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| app | ||
| public | ||
| Dockerfile | ||
| package.json | ||
| react-router.config.ts | ||
| server.ts | ||
| tsconfig.json | ||
| vite.config.ts | ||
| vitest.config.ts | ||