Frank/Escapepage
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix Mercure CORS to allow both www and bare domain

Browse Source 
Production's MERCURE_CORS_ALLOWED_ORIGINS only allowed
https://escapepage.com, but nginx has no www redirect
(server_name _;), so the site is also reachable at
https://www.escapepage.com. Visitors on the www host got a CORS
error on the Mercure EventSource connection since the Origin header
didn't match the allow-list. Dev's .env already allowed both; bring
docker/.env.dist in line, and fix its stale MERCURE_PUBLIC_URL
(bare domain instead of the mercure. subdomain actually used).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Frank
2026-07-04 15:26:17 +02:00
co-authored by Claude Sonnet 5
parent c4e5139ec4
commit b4f6a531c9
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docker/.env.dist
+2 -2
View File
@@ -21,9 +21,9 @@ MYSQL_ROOT_PASSWORD=CHANGEME_MYSQL_ROOT_PASSWORD
# Mercure # Mercure
MERCURE_URL=http://mercure/.well-known/mercure MERCURE_URL=http://mercure/.well-known/mercure
MERCURE_PUBLIC_URL=https://escapepage.com/.well-known/mercure MERCURE_PUBLIC_URL=https://mercure.escapepage.com/.well-known/mercure
MERCURE_JWT_SECRET=CHANGEME_MERCURE_JWT_SECRET MERCURE_JWT_SECRET=CHANGEME_MERCURE_JWT_SECRET
MERCURE_CORS_ALLOWED_ORIGINS=https://escapepage.com MERCURE_CORS_ALLOWED_ORIGINS="https://www.escapepage.com https://escapepage.com"
MERCURE_TOPIC_BASE=https://escapepage.com MERCURE_TOPIC_BASE=https://escapepage.com
# Recaptcha # Recaptcha