CORS preflight issue — backend not returning Access-Control-Allow-Origin

[gitops-softinator]

Hi, I’m integrating with the backend from your repo and ran into an issue related to CORS.
My frontend runs on:
https://social.softinator.ai/

When it calls the backend on Railway:
https://postiz-production-cebc.up.railway.app/api/auth/register

The browser blocks the request because the preflight OPTIONS response does not include Access-Control-Allow-Origin.

Here is the exact preflight response:

HTTP/2 204
access-control-allow-headers: Content-Type,Authorization,x-copilotkit-runtime-client-gql-version
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE
access-control-expose-headers: reload,onboarding,activate,x-copilotkit-runtime-client-gql-version
vary: Origin
x-powered-by: Express

As you can see, Access-Control-Allow-Origin is missing.
This causes the browser to fail the request with net::ERR_FAILED.

From looking at main.ts, it seems the CORS configuration depends on:

origin: [
  process.env.FRONTEND_URL,
  'http://localhost:6274',
  ...(process.env.MAIN_URL ? [process.env.MAIN_URL] : []),
],

But even after setting:

FRONTEND_URL=https://social.softinator.ai
MAIN_URL=https://social.softinator.ai

… the server still omits Access-Control-Allow-Origin in the preflight response.

This usually happens when the origin check does not match exactly, or when the CORS middleware is not applied early enough in NestJS bootstrapping.

A solution is:

Add this to your backend code.

app.enableCors({
origin: (origin, callback) => {
const whitelist = [
process.env.FRONTEND_URL,
process.env.MAIN_URL,
'http://localhost:6274',
].filter(Boolean);

if (!origin || whitelist.includes(origin)) {
  callback(null, origin || true);
} else {
  callback(new Error('Not allowed by CORS'));
}

},
credentials: true,
allowedHeaders: ['Content-Type', 'Authorization', 'x-copilotkit-runtime-client-gql-version'],
methods: ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS'],
});

Solution 2 is:

Ensure CORS is not overridden by rawBody or other middleware

Sometimes putting CORS after certain middlewares causes NestJS to skip adding the headers.