Replace a wildcard CORS setting with an allowlist

About this exercise

Fix this CORS setup so only your live front ends can call the API with cookies. Use the origins from the deployment notes in a const ALLOWED_ORIGINS array passed straight to origin (no callback function), keep credentials on, and don't add origins that are gone. Give the fixed setup in exactly 1 code block of at most 10 lines, with under 30 words outside it.

Common mistakes when you ask AI for this

• Not giving the real origins or style. The AI writes placeholder origins or a custom callback function your team has to review line by line. Try: Say: "A const ALLOWED_ORIGINS array with the two origins from the notes, passed directly as origin."
• Keeping dead origins. The AI adds staging and localhost to be helpful, and an unclaimed staging domain is a takeover risk. Try: Add: "Don't include staging or localhost, and no special case for missing Origin."
• Turning off credentials. The AI's quickest fix for the browser error is dropping credentials, which breaks login. Try: Say: "Keep credentials: true and the same methods."
• A CORS lecture. The AI explains CORS for paragraphs around the fix. Try: Limit it: "1 code block, under 20 words outside it."

What a strong prompt includes

• Uses the real origins
• Drops dead origins
• Keeps credentials
• Asks for one code block
• Limits the explanation

Practice this now ↑

Related exercises

• Add dark mode by overriding your existing CSS variables (Coding AI · Software developers)
• Add input checks to your number guessing game (Coding AI · High school students)
• Add labels to a signup form without rewriting the page (Coding AI · High school students)
• Announce the employee assistance program in three steps (Writing AI · HR and recruiting)
• Answer a cyber insurance form honestly from your notes (Cybersecurity AI · Small business owners)