mirror of
https://github.com/Crosstalk-Solutions/project-nomad.git
synced 2026-10-17 05:14:19 +02:00
origin: ['*'] in config/cors.ts never matches a real Origin header, since @adonisjs/cors only treats '*' as a wildcard when it's the bare string, not inside an array. So no Access-Control-Allow-Origin is ever sent, on any route, blocking any other app from reading NOMAD's map tiles cross-origin. Add a middleware scoped to the four map asset path prefixes instead of widening the global config, which would also expose the write API since credentials: true is already set there. Registered before @adonisjs/cors so it can answer OPTIONS preflights on map paths itself; the built-in middleware ends any preflight it can't match an origin for before this one would otherwise run. |
||
|---|---|---|
| .. | ||
| eval | ||
| functional | ||
| standalone | ||
| unit | ||
| bootstrap.ts | ||