From b4f6a531c94a3887d3dc93f54edd834a74ae1fef Mon Sep 17 00:00:00 2001 From: Frank Date: Sat, 4 Jul 2026 15:26:17 +0200 Subject: [PATCH] Fix Mercure CORS to allow both www and bare domain Production's MERCURE_CORS_ALLOWED_ORIGINS only allowed https://escapepage.com, but nginx has no www redirect (server_name _;), so the site is also reachable at https://www.escapepage.com. Visitors on the www host got a CORS error on the Mercure EventSource connection since the Origin header didn't match the allow-list. Dev's .env already allowed both; bring docker/.env.dist in line, and fix its stale MERCURE_PUBLIC_URL (bare domain instead of the mercure. subdomain actually used). Co-Authored-By: Claude Sonnet 5 --- docker/.env.dist | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docker/.env.dist b/docker/.env.dist index 41a2a84..f7a64dd 100644 --- a/docker/.env.dist +++ b/docker/.env.dist @@ -21,9 +21,9 @@ MYSQL_ROOT_PASSWORD=CHANGEME_MYSQL_ROOT_PASSWORD # Mercure MERCURE_URL=http://mercure/.well-known/mercure -MERCURE_PUBLIC_URL=https://escapepage.com/.well-known/mercure +MERCURE_PUBLIC_URL=https://mercure.escapepage.com/.well-known/mercure MERCURE_JWT_SECRET=CHANGEME_MERCURE_JWT_SECRET -MERCURE_CORS_ALLOWED_ORIGINS=https://escapepage.com +MERCURE_CORS_ALLOWED_ORIGINS="https://www.escapepage.com https://escapepage.com" MERCURE_TOPIC_BASE=https://escapepage.com # Recaptcha