Craze-Data-check/api/_cors.js

const LOCALHOST_ORIGIN_PREFIXES = ['http://localhost:', 'http://127.0.0.1:'];

export function isAllowedOrigin(origin) {
  if (!origin) return false;

  if (LOCALHOST_ORIGIN_PREFIXES.some(prefix => origin.startsWith(prefix))) {
    return true;
  }

  try {
    const url = new URL(origin);
    if (url.hostname === 'craze-data-check.vercel.app') return true;
    if (url.hostname.endsWith('.vercel.app')) return true;
    if (process.env.APP_URL) {
      const appUrl = new URL(process.env.APP_URL);
      if (url.hostname === appUrl.hostname) return true;
    }
    if (process.env.VERCEL_URL) {
      const vercelHost = process.env.VERCEL_URL.replace(/^https?:\/\//, '');
      if (url.hostname === vercelHost) return true;
    }
  } catch {
    return false;
  }

  return false;
}

export function applyCors(req, res, methods) {
  const origin = req.headers.origin;
  if (isAllowedOrigin(origin)) {
    res.setHeader('Access-Control-Allow-Origin', origin);
  }
  res.setHeader('Access-Control-Allow-Methods', methods);
  res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization, apikey');
  res.setHeader('Access-Control-Max-Age', '86400');
  res.setHeader('Vary', 'Origin');
}