INNER CODE UNIT · TypeScript

createApp

karmacircleCommunity/KarmaCircle · apps/api/src/app.ts:18

export function createApp(): Express {
  const app = express();

  // Vercel (and any reverse proxy) sits in front of this app. Without this,
  // req.ip is the proxy's address, so every client shares one rate-limit
  // bucket: one attacker exhausts authLimiter's 20 attempts for everyone.
  app.set("trust proxy", 1);

  app.use(helmet());
  app.use(compression());
  app.use(pinoHttp({ logger }));

  /**
   * An explicit allowlist, echoing back the caller's own origin only when it
   * is on the list. The previous version always answered with the single
   * configured ORIGIN_URL regardless of who asked, so the moment a second
   * legitimate origin existed (localhost alongside a deployed frontend) it
   * was blocked, and its IGNORE_ORIGINS escape hatch fixed that locally by

View source record →