fix: do not add localhost to CORS

Don't add localhost, as it is not needed.
SignalK · Oct 10, 2023 · becf29d · becf29d
1 parent 53a12f0
commit becf29d
Showing 1 changed file with 5 additions and 1 deletion.
diff --git a/src/cors.ts b/src/cors.ts
@@ -49,7 +49,11 @@ export const handleAdminUICORSOrigin = (
     securityConfig.allowedCorsOrigins.length > 0
   ) {
     allowedCorsOrigins = securityConfig.allowedCorsOrigins?.split(',')
-    if (allowedCorsOrigins.indexOf(securityConfig.adminUIOrigin) === -1) {
+    const adminUIOriginUrl = new URL(securityConfig.adminUIOrigin)
+    if (
+      allowedCorsOrigins.indexOf(securityConfig.adminUIOrigin) === -1 &&
+      adminUIOriginUrl.hostname !== 'localhost'
+    ) {
       allowedCorsOrigins.push(securityConfig.adminUIOrigin)
     }
   }