From f48d98cf3aed3229a0982759b1420f8ca0950f46 Mon Sep 17 00:00:00 2001 From: neodk2004 Date: Mon, 10 Aug 2026 12:50:40 +0200 Subject: [PATCH] fix(security): lock Mux upload CORS origin to the real domain in prod cors_origin was hardcoded to "*" for all environments. Now restricted to NEXT_PUBLIC_APP_URL when NODE_ENV=production; stays "*" in dev so localhost uploads keep working. --- src/trpc/routers/videos.ts | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/src/trpc/routers/videos.ts b/src/trpc/routers/videos.ts index 4658343..b9d46c7 100644 --- a/src/trpc/routers/videos.ts +++ b/src/trpc/routers/videos.ts @@ -32,8 +32,11 @@ export const videosRouter = router({ // Create Mux direct upload — client PUTs directly to the returned URL const upload = await mux.video.uploads.create({ - // "*" allows uploads from any origin (dev + prod); restrict to APP_URL in production if needed - cors_origin: "*", + // "*" in dev so localhost uploads still work; locked to the real + // domain in production (this project shares one Clerk/DB between + // local dev and prod, but Mux's CORS origin still differs by env). + cors_origin: + process.env.NODE_ENV === "production" ? (process.env.NEXT_PUBLIC_APP_URL ?? "*") : "*", new_asset_settings: { playback_policy: ["public"], max_resolution_tier: "1080p",