From 73b510589e0f2291cacbab907d0a46d99b4f993d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?S=CA=9C=C9=AA=C9=B4=E1=B4=87=C9=AA=20N=E1=B4=8F=E1=B4=9C?=
 =?UTF-8?q?=E1=B4=A2=E1=B4=87=C9=B4?=
 <157171073+Shineii86@users.noreply.github.com>
Date: Thu, 25 Jun 2026 10:42:09 +0530
Subject: [PATCH] =?UTF-8?q?Fix=20CORS=20=E2=80=94=20allow=20non-browser=20?=
 =?UTF-8?q?requests=20(no=20Origin=20header)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 server.js | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/server.js b/server.js
index fe5ed68..b4e672d 100644
--- a/server.js
+++ b/server.js
@@ -91,9 +91,13 @@ app.use((req, res, next) => {
   const isProduction = process.env.VERCEL || process.env.NODE_ENV === "production";
 
   if (allowedOrigins && allowedOrigins.length > 0) {
-    if (allowedOrigins.includes("*") || (origin && allowedOrigins.includes(origin))) {
-      res.setHeader("Access-Control-Allow-Origin", origin || "*");
-    } else if (isProduction) {
+    if (allowedOrigins.includes("*")) {
+      res.setHeader("Access-Control-Allow-Origin", "*");
+    } else if (origin && allowedOrigins.includes(origin)) {
+      res.setHeader("Access-Control-Allow-Origin", origin);
+    } else if (!origin && !isProduction) {
+      res.setHeader("Access-Control-Allow-Origin", "*");
+    } else if (origin) {
       return res.status(403).json({ success: false, message: "Origin not allowed" });
     }
   } else {