Spec CORS config between ThreadCraft (localhost:3000) and easystitch-service (localhost:8080) #13

New issue

Closed

opened 2026-06-25 03:11:38 +00:00 by Mark · 1 comment

Mark commented

2026-06-25 03:11:38 +00:00

Owner

easystitch-service#1 shipped without a CORS middleware. The Vite dev proxy in service#3 only works for /api/easystitch/* requests routed through the proxy. Direct fetches from the browser to the service URL (preview mode, production behind a different origin) will be blocked.

Decide:

Allow-list http://localhost:3000 and the prod frontend origin in the service's CORS middleware
Or document that the vite proxy is the only dev path and prod must serve the frontend from the same origin as the service

Acceptance: a test in easystitch-service proving an OPTIONS preflight from the frontend origin returns the right headers, AND ThreadCraft can call the service from the browser console without going through the vite proxy.

easystitch-service#1 shipped without a CORS middleware. The Vite dev proxy in service#3 only works for `/api/easystitch/*` requests routed through the proxy. Direct fetches from the browser to the service URL (preview mode, production behind a different origin) will be blocked. Decide: - Allow-list `http://localhost:3000` and the prod frontend origin in the service's CORS middleware - Or document that the vite proxy is the only dev path and prod must serve the frontend from the same origin as the service Acceptance: a test in easystitch-service proving an OPTIONS preflight from the frontend origin returns the right headers, AND ThreadCraft can call the service from the browser console without going through the vite proxy.

Mark added the

feature-request

needs-decompose

triage-approved

labels

2026-06-25 03:11:38 +00:00

Mark removed the

feature-request

label

2026-06-27 10:49:39 +00:00

Mark commented

2026-06-27 11:16:42 +00:00

Author

Owner

Auto-triage: needs decompose

Marked triage-approved + needs-decompose. decompose-executor will pick this up and break it into implementable sub-issues.

## Auto-triage: needs decompose Marked `triage-approved` + `needs-decompose`. decompose-executor will pick this up and break it into implementable sub-issues.

Mark

2026-06-27 11:17:25 +00:00