Skip to content

fix: CORS ERROR #70

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
y10b wants to merge 1 commit into from
Closed

fix: CORS ERROR #70

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 14 additions & 1 deletion src/app.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,20 @@ const app = express();
const PORT = process.env.PORT;
const corsOrigins = process.env.CORS_ORIGINS
? process.env.CORS_ORIGINS.split(",").map((origin) => origin.trim())
: ["https://toieeeeeea.shop", "https://www.toieeeeeea.shop"];
: process.env.NODE_ENV === "production"
? [
"https://toieeeeeea.shop",
"https://www.toieeeeeea.shop",
"https://6-sprint-mission-fe-seven.vercel.app",
"https://6-sprint-mission-fe-y10bs-projects.vercel.app",
"https://pandamarket-frontend.vercel.app", // 추가 예상 도메인
]
: [
"http://localhost:3000",
"http://127.0.0.1:3000",
"https://toieeeeeea.shop",
"https://www.toieeeeeea.shop",
];

const corsOptions = {
origin: corsOrigins, // 환경변수에서 읽은 origins 사용
Expand Down
17 changes: 9 additions & 8 deletions src/controllers/refreshAccessToken.controller.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,16 +23,17 @@ export const refreshAccessToken = async (
try {
const newAccessToken = await authService.refreshAccessToken(refreshToken);

// 새로운 액세스 토큰을 쿠키에 설정 - CloudFront HTTPS 지원
res.cookie("accessToken", newAccessToken, {
// 개발/프로덕션 환경에 따른 쿠키 설정
const cookieOptions = {
httpOnly: true,
secure: process.env.NODE_ENV === "production", // 프로덕션에서만 HTTPS 필요
sameSite: "none", // 크로스 도메인 허용
secure: process.env.NODE_ENV === "production",
sameSite: process.env.NODE_ENV === "production" ? "none" : "lax",
maxAge: 15 * 60 * 1000, // 15분
...(process.env.NODE_ENV === "production" && {
domain: ".toieeeeeea.shop",
}),
});
// domain 설정을 제거하여 크로스 도메인 쿠키 문제 해결
} as const;

// 새로운 액세스 토큰을 쿠키에 설정
res.cookie("accessToken", newAccessToken, cookieOptions);

res.json({
success: true,
Expand Down
27 changes: 13 additions & 14 deletions src/controllers/user.controller.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,26 +61,25 @@ export const loginUser = async (
data: { refreshToken },
});

// refreshToken을 httpOnly 쿠키로 설정 - CloudFront HTTPS 지원
res.cookie("refreshToken", refreshToken, {
// 개발/프로덕션 환경에 따른 쿠키 설정
const cookieOptions = {
httpOnly: true,
secure: process.env.NODE_ENV === "production", // 프로덕션에서만 HTTPS 필요
sameSite: "none", // 크로스 도메인 허용
secure: process.env.NODE_ENV === "production",
sameSite: process.env.NODE_ENV === "production" ? "none" : "lax",
// 프로덕션에서는 도메인을 명시적으로 설정하지 않아 모든 서브도메인에서 작동하도록 함
// domain 설정을 제거하여 쿠키가 설정된 정확한 도메인에서만 작동하도록 변경
} as const;

// refreshToken을 httpOnly 쿠키로 설정
res.cookie("refreshToken", refreshToken, {
...cookieOptions,
maxAge: 7 * 24 * 60 * 60 * 1000, // 7일
...(process.env.NODE_ENV === "production" && {
domain: ".toieeeeeea.shop",
}),
});

// accessToken도 httpOnly 쿠키로 설정 - CloudFront HTTPS 지원
// accessToken도 httpOnly 쿠키로 설정
res.cookie("accessToken", accessToken, {
httpOnly: true,
secure: process.env.NODE_ENV === "production", // 프로덕션에서만 HTTPS 필요
sameSite: "none", // 크로스 도메인 허용
...cookieOptions,
maxAge: 15 * 60 * 1000, // 15분
...(process.env.NODE_ENV === "production" && {
domain: ".toieeeeeea.shop",
}),
});

// 응답에는 민감하지 않은 사용자 정보만 포함
Expand Down