fix: cors origins parsing issue

Author: CodeMeAPixel

cmd/api/main.go

@@ -22,6 +22,7 @@ import (
 	"context"
 	"os"
 	"os/signal"
+	"strings"
 	"syscall"
 	"time"
 
@@ -221,7 +222,7 @@ func setupMiddleware(app *fiber.App, sentryHandler fiber.Handler, cfg *config.Co
 		Format: "[${time}] ${status} - ${latency} ${method} ${path}\n",
 	}))
 	app.Use(cors.New(cors.Config{
-		AllowOrigins:     cfg.CORSOrigins,
+		AllowOrigins:     strings.Join(cfg.CORSOrigins, ","),
 		AllowHeaders:     "Origin, Content-Type, Accept, Authorization, X-API-Key",
 		AllowMethods:     "GET, POST, PUT, DELETE, OPTIONS, PATCH",
 		AllowCredentials: true,

internal/config/config.go

@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"os"
 	"strconv"
+	"strings"
 
 	"github.com/nodebyte/backend/internal/crypto"
 	"github.com/nodebyte/backend/internal/database"
@@ -27,7 +28,7 @@ type Config struct {
 	APIKey string
 
 	// CORS
-	CORSOrigins string
+	CORSOrigins []string
 
 	// Pterodactyl Panel
 	PterodactylURL          string
@@ -68,7 +69,7 @@ func Load() (*Config, error) {
 		DatabaseURL: os.Getenv("DATABASE_URL"),
 		RedisURL:    getEnv("REDIS_URL", "localhost:6379"),
 		APIKey:      os.Getenv("BACKEND_API_KEY"),
-		CORSOrigins: getEnv("CORS_ORIGINS", "*"),
+		CORSOrigins: parseCORSOrigins(getEnv("CORS_ORIGINS", "https://nodebyte.host")),
 
 		// Panel settings
 		PterodactylURL:          os.Getenv("PTERODACTYL_URL"),
@@ -131,6 +132,16 @@ func getEnvBool(key string, defaultValue bool) bool {
 	return defaultValue
 }
 
+func parseCORSOrigins(originsStr string) []string {
+	var origins []string
+	for _, origin := range strings.Split(originsStr, ",") {
+		if trimmed := strings.TrimSpace(origin); trimmed != "" {
+			origins = append(origins, trimmed)
+		}
+	}
+	return origins
+}
+
 // MergeFromDB loads configuration overrides from the `config` table in the
 // main application database. Values stored in the DB will overwrite the
 // corresponding fields on the provided Config when present.

internal/config/config_test.go

@@ -99,7 +99,9 @@ func TestLoad(t *testing.T) {
 			},
 			expectErr: false,
 			checkFn: func(cfg *Config) bool {
-				return cfg.CORSOrigins == "https://example.com,https://app.example.com"
+				return len(cfg.CORSOrigins) == 2 &&
+					cfg.CORSOrigins[0] == "https://example.com" &&
+					cfg.CORSOrigins[1] == "https://app.example.com"
 			},
 		},
 		{