Careeroza

CORS

Allowing Other Origins

Browsers block calls from https://partner.example.com to your API unless your response has CORS headers. Your own Next.js pages are same-origin and need nothing. For other front-ends:

// app/api/public/products/route.ts
const ALLOWED = ['https://partner.shopease.in', 'http://localhost:5173'];

function corsHeaders(origin: string | null): Record<string, string> {
  if (!origin || !ALLOWED.includes(origin)) return {};
  return {
    'Access-Control-Allow-Origin': origin,
    'Access-Control-Allow-Methods': 'GET, POST, OPTIONS',
    'Access-Control-Allow-Headers': 'Content-Type, Authorization',
    Vary: 'Origin',
  };
}

export async function OPTIONS(req: Request) {
  return new Response(null, { status: 204, headers: corsHeaders(req.headers.get('origin')) });
}

export async function GET(req: Request) {
  const products = await listPublicProducts();
  return Response.json(products, { headers: corsHeaders(req.headers.get('origin')) });
}

Preflight in Action

Example

curl -i -X OPTIONS localhost:3000/api/public/products -H "Origin: https://partner.shopease.in" -H "Access-Control-Request-Method: GET"

Example output

HTTP/1.1 204 No Content
access-control-allow-origin: https://partner.shopease.in
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Content-Type, Authorization
vary: Origin

Note: Never send Access-Control-Allow-Origin: * together with cookies/credentials. Allow a list of known origins.