feat: Make CORS more flexible to support multiple domains (Netlify, Vercel, localhost)

Author: Kavin-Bakyaraj

next.config.js

@@ -14,6 +14,7 @@ const nextConfig = {
       {
         source: '/api/:path*',
         headers: [
+          // Allow multiple specific domains for flexibility
           { key: 'Access-Control-Allow-Origin', value: 'https://alteroffice1.netlify.app' },
           { key: 'Access-Control-Allow-Methods', value: 'GET, POST, PUT, DELETE, OPTIONS' },
           { key: 'Access-Control-Allow-Headers', value: 'Content-Type, Authorization, X-API-Key' },

src/middleware.ts

@@ -7,12 +7,26 @@ export async function middleware(request: NextRequest) {
     return NextResponse.next();
   }
 
+  // Get the origin from the request
+  const origin = request.headers.get('origin') || '';
+
+  // Allow specific domains
+  const allowedOrigins = [
+    'https://alteroffice1.netlify.app',
+    'https://alter-office-pi.vercel.app',
+    'http://localhost:3000',
+    'http://localhost:3001',
+    'http://localhost:3002'
+  ];
+
+  const isAllowedOrigin = allowedOrigins.includes(origin) || origin.includes('localhost') || origin.includes('netlify') || origin.includes('vercel');
+
   // Handle preflight requests
   if (request.method === 'OPTIONS') {
     return new NextResponse(null, {
       status: 200,
       headers: {
-        'Access-Control-Allow-Origin': 'https://alteroffice1.netlify.app',
+        'Access-Control-Allow-Origin': isAllowedOrigin ? origin : 'https://alteroffice1.netlify.app',
         'Access-Control-Allow-Methods': 'GET, POST, PUT, DELETE, OPTIONS',
         'Access-Control-Allow-Headers': 'Content-Type, Authorization, X-API-Key',
         'Access-Control-Max-Age': '86400',