From 30feda703a35dbdbce483884e2d026ca8fc98ba1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?S=CA=9C=C9=AA=C9=B4=E1=B4=87=C9=AA=20N=E1=B4=8F=E1=B4=9C?=
 =?UTF-8?q?=E1=B4=A2=E1=B4=87=C9=B4?=
 <157171073+Shineii86@users.noreply.github.com>
Date: Tue, 9 Jun 2026 11:05:16 +0530
Subject: [PATCH] fix: CORS header missing when ALLOWED_ORIGINS env not set

Browser blocks cross-origin requests from AniKotoWeb because
Access-Control-Allow-Origin was never set when ALLOWED_ORIGINS
was undefined on Vercel. Changed condition to allow all origins
when env var is not configured.
---
 server.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server.js b/server.js
index a2e186b..36c448f 100644
--- a/server.js
+++ b/server.js
@@ -46,7 +46,7 @@ const allowedOrigins = process.env.ALLOWED_ORIGINS?.split(",");
 // NOTE: Single unified CORS middleware — handles all origin validation
 app.use((req, res, next) => {
   const origin = req.headers.origin;
-  if (allowedOrigins && (allowedOrigins.includes("*") || (origin && allowedOrigins.includes(origin)))) {
+  if (!allowedOrigins || allowedOrigins.includes("*") || (origin && allowedOrigins.includes(origin))) {
     res.setHeader("Access-Control-Allow-Origin", origin || "*");
   }
   res.setHeader("Access-Control-Allow-Methods", "GET");