Skip to content

Fix Auth Backend, Vercel Routing, and CORS #5

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Kaushal-15 wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Fix Auth Backend, Vercel Routing, and CORS #5

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 8 additions & 2 deletions app/Backend/config/passport-config.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,14 +14,20 @@ const getCleanEnvVar = (varName) => {
// Get and validate Google OAuth credentials
const clientID = getCleanEnvVar('GOOGLE_CLIENT_ID');
const clientSecret = getCleanEnvVar('GOOGLE_CLIENT_SECRET');
const callbackURL = getCleanEnvVar('GOOGLE_CALLBACK_URL') || 'http://localhost:5000/auth/google/callback';

// Determine callback URL
let defaultCallback = 'http://localhost:3000/auth/google/callback';
if (process.env.PORT) {
defaultCallback = `http://localhost:${process.env.PORT}/auth/google/callback`;
}
const callbackURL = getCleanEnvVar('GOOGLE_CALLBACK_URL') || defaultCallback;

if (!clientID || !clientSecret) {
console.error('\n❌ Missing required Google OAuth environment variables!\n');
console.error('Add these to your .env file (WITHOUT quotes):');
console.error(' GOOGLE_CLIENT_ID=your_client_id_here');
console.error(' GOOGLE_CLIENT_SECRET=your_client_secret_here');
console.error(' GOOGLE_CALLBACK_URL=http://localhost:5000/auth/google/callback');
console.error(` GOOGLE_CALLBACK_URL=${defaultCallback}`);
console.error(' SESSION_SECRET=your_random_secret\n');
throw new Error('Missing Google OAuth credentials');
}
Expand Down
5 changes: 4 additions & 1 deletion app/Backend/routes/auth.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,8 +79,11 @@ router.get('/check-name/:name', async (req, res) => {
*/
const checkUsernameHandler = async (req, res) => {
try {
// Force JSON content type
res.setHeader('Content-Type', 'application/json');

// accepting from query (GET) or body (POST)
const username = req.query.username || req.body.username || req.params.username;
const username = req.query.username || req.body.username || req.params.username || req.query.name || req.body.name;

if (!username || username.trim().length < 2) {
return res.status(400).json({
Expand Down
27 changes: 26 additions & 1 deletion app/Backend/server.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,9 +73,34 @@ app.get("/debug/cookies", (req, res) => {
});

// ✅ Configure CORS *before* Helmet or routes
const allowedOrigins = [
"http://localhost:5173",
"http://localhost:3000",
"http://localhost:5000",
];

if (process.env.FRONTEND_URL) {
allowedOrigins.push(process.env.FRONTEND_URL);
}
Comment on lines +82 to +84

@coderabbitai coderabbitai Bot Feb 4, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Normalize FRONTEND_URL to avoid trailing-slash mismatches.

If FRONTEND_URL ends with /, origin comparisons will fail in production. Consider trimming.

💡 Proposed fix 
 if (process.env.FRONTEND_URL) {
-  allowedOrigins.push(process.env.FRONTEND_URL);
+  allowedOrigins.push(process.env.FRONTEND_URL.replace(/\/$/, ''));
 }
🤖 Prompt for AI Agents 
In `@app/Backend/server.js` around lines 82 - 84, Normalize the FRONTEND_URL
before pushing into allowedOrigins to avoid trailing-slash mismatches: read
process.env.FRONTEND_URL, trim surrounding whitespace and remove any trailing
slashes (e.g. using a regexp like .replace(/\/+$/, '')), then push the
normalized value into allowedOrigins instead of the raw value; update the code
around the allowedOrigins push that references process.env.FRONTEND_URL to use
this normalized variable.


app.use(
cors({
origin: process.env.FRONTEND_URL || "http://localhost:5173",
origin: function (origin, callback) {
// Allow requests with no origin (like mobile apps or curl requests)
if (!origin) return callback(null, true);

if (allowedOrigins.includes(origin) || origin.endsWith('.vercel.app')) {
return callback(null, true);
}

// In development, allow all
if (process.env.NODE_ENV !== 'production') {
return callback(null, true);
}

const msg = 'The CORS policy for this site does not allow access from the specified Origin.';
return callback(new Error(msg), false);
},
credentials: true,
methods: ["GET", "POST", "PUT", "DELETE", "OPTIONS"],
allowedHeaders: ["Content-Type", "Authorization", "Cache-Control", "Pragma"],
Expand Down
13 changes: 12 additions & 1 deletion vercel.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,9 +18,20 @@
"src": "/api/(.*)",
"dest": "/app/Backend/server.js"
},
{
"src": "/auth/(.*)",
"dest": "/app/Backend/server.js"
},
{
"src": "/(.*)",
"dest": "/app/frontend/$1"
},
{
"handle": "filesystem"
},
{
"src": "/(.*)",
"dest": "/app/frontend/index.html"
}
]
}
}