From c71539ef5b00cf7316b2f7581c991d8516cfe174 Mon Sep 17 00:00:00 2001 From: Philippe Serhal Date: Sun, 25 Jan 2026 20:25:33 -0500 Subject: [PATCH] fix(cli): allow any localhost port in CORS config When port 3000 is unavailable, Nuxt/Vite automatically picks an alternative port: ``` [get-port] Unable to find an available port (tried 3000 on host "localhost"). Using alternative port 3001. ``` But the connector CORS config was hardcoded to only allow the prod host and `http://localhost:3000`, causing local authentication to fail in an opaque manner. It now uses a regex pattern to allow any localhost port. This seems fine from a security perspective, and there aren't alternatives with great DX that I can think of. --- cli/src/server.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/cli/src/server.ts b/cli/src/server.ts index 1e7498bb73..75bd591c6e 100644 --- a/cli/src/server.ts +++ b/cli/src/server.ts @@ -37,7 +37,7 @@ function generateOperationId(): string { } const corsOptions: CorsOptions = { - origin: ['https://npmx.dev', 'http://localhost:3000'], + origin: ['https://npmx.dev', /^http:\/\/localhost:\d+$/], methods: ['GET', 'POST', 'DELETE', 'OPTIONS'], allowHeaders: ['Content-Type', 'Authorization'], }