From 92f1c884c9842c60615da4a3f843edf4a6958bb5 Mon Sep 17 00:00:00 2001 From: sdarbinyan Date: Thu, 20 Aug 2026 16:29:05 +0400 Subject: [PATCH] fix(proxy): strip upstream browser origin nginx owns the validated CORS response; the live :445 backend rejects requests when the browser Origin is forwarded. --- docs/backend/TENANT-API-DOMAIN-HANDOFF.md | 5 ++++- scripts/deploy/configure-api-domain.sh | 3 +++ 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/docs/backend/TENANT-API-DOMAIN-HANDOFF.md b/docs/backend/TENANT-API-DOMAIN-HANDOFF.md index cc4d7b6..749482a 100644 --- a/docs/backend/TENANT-API-DOMAIN-HANDOFF.md +++ b/docs/backend/TENANT-API-DOMAIN-HANDOFF.md @@ -77,7 +77,10 @@ It creates the shared `api.gorbushka.market`, issues/renews its certificate, configures CORS for `gorbushka.market` and its subdomains, and proxies all paths to the backend. A request from `store1.gorbushka.market` reaches upstream with `Host` and `X-Storefront-Host` set to `store1.gorbushka.market`, while -`X-Forwarded-Host` remains `api.gorbushka.market`. +`X-Forwarded-Host` remains `api.gorbushka.market`. nginx terminates CORS and +strips the browser `Origin` before proxying because the current `:445` service +rejects direct browser origins; tenant identity is carried by the trusted +storefront header instead. `store1.example.com` requires no additional API DNS or certificate; it uses the same `api.example.com` certificate as the root storefront. diff --git a/scripts/deploy/configure-api-domain.sh b/scripts/deploy/configure-api-domain.sh index 409bca4..dac2c41 100755 --- a/scripts/deploy/configure-api-domain.sh +++ b/scripts/deploy/configure-api-domain.sh @@ -72,6 +72,9 @@ server { proxy_set_header Host \$storefront_host; proxy_set_header X-Forwarded-Host $API_DOMAIN; proxy_set_header X-Storefront-Host \$storefront_host; + # nginx has already validated and answered CORS. The existing backend + # rejects browser Origin on :445, so do not forward it a second time. + proxy_set_header Origin ""; proxy_set_header X-Real-IP \$remote_addr; proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto https;