Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/nelrondon/backend-proyecto-estructuras/llms.txt

Use this file to discover all available pages before exploring further.

The Estructuras Backend API uses the cors npm package to enforce a strict allowlist of origins that are permitted to make cross-origin HTTP requests. Because authentication relies on HTTP-only cookies, CORS must be configured with credentials: true so browsers include those cookies on cross-origin requests. Any origin not present in the allowlist receives an error and the request is rejected before it reaches any route handler.

​
Allowed Origins

The list of trusted origins is defined in src/config.js alongside the other environment-level constants: 
import dotenv from "dotenv";
dotenv.config();

export const { PORT = 3000, SALT_ROUNDS = 10, SECRET_KEY } = process.env;

export const ALLOWED_ORIGINS = [
  "http://localhost:5173", // Frontend de desarrollo
  "https://proyecto-estructuras-topaz.vercel.app",
];
OriginPurpose
http://localhost:5173Local Vite development server (default Vite port)
https://proyecto-estructuras-topaz.vercel.appProduction frontend deployed on Vercel

​
CORS Middleware Configuration

The CORS middleware is registered in src/index.js as the very first middleware so that preflight OPTIONS requests and cross-origin rejections are handled before any application logic runs. 
import express from "express";
import { PORT, ALLOWED_ORIGINS } from "./config.js";
import cors from "cors";

const app = express();

app.use(
  cors({
    origin: function (origin, callback) {
      if (!origin) return callback(null, true);

      if (ALLOWED_ORIGINS.includes(origin)) {
        return callback(null, true);
      } else {
        return callback(new Error("Not allowed by CORS"));
      }
    },
    credentials: true,
  })
);

app.disable("x-powered-by");

​
How the origin callback works

  1. No Origin header (!origin) — The request is allowed unconditionally. This covers server-to-server calls, curl commands, and Postman requests where no origin is sent. The callback resolves with callback(null, true).
  2. Origin in ALLOWED_ORIGINS — The browser-sent Origin header matches an entry in the list. The callback resolves with callback(null, true) and the browser receives the appropriate Access-Control-Allow-Origin header.
  3. Origin not in ALLOWED_ORIGINS — The callback resolves with callback(new Error("Not allowed by CORS")). The cors package converts this into a standard error response and the browser blocks the request.

​
credentials: true

Setting credentials: true instructs the cors package to include the Access-Control-Allow-Credentials: true response header. Without this header, browsers refuse to expose cross-origin responses to JavaScript code when the request was made with credentials: 'include' — which is exactly how the frontend must send requests so that the authentication cookie is attached.
The authentication cookie is set with sameSite: 'none' and secure: true. secure: true means the cookie is only transmitted over HTTPS. If your production backend is not served over HTTPS, browsers will silently discard the cookie on every response and none of your authenticated routes will work. Always terminate TLS at your reverse proxy or hosting platform before traffic reaches the Express process.

​
x-powered-by disabled

app.disable("x-powered-by");
Express adds an X-Powered-By: Express header to every response by default. Disabling it removes a fingerprint that attackers could use to target known Express vulnerabilities. This is a minor but costless hardening step.

​
Adding a New Allowed Origin

To permit a new frontend URL — for example, a staging environment — open src/config.js and append the origin to the ALLOWED_ORIGINS array: 
export const ALLOWED_ORIGINS = [
  "http://localhost:5173",
  "https://proyecto-estructuras-topaz.vercel.app",
  "https://staging.proyecto-estructuras.vercel.app", // new staging origin
];
Origins must include the protocol (https://) and must not include a trailing slash. https://ejemplo.com and https://ejemplo.com/ are treated as different strings by the includes check, so only the slash-free form will match the Origin header that browsers send.
Restart the server after editing config.js. No other file needs to change — the origin callback reads from ALLOWED_ORIGINS at runtime, so a single array update propagates to the CORS check automatically.

​
Testing CORS Behavior

curl -i http://localhost:3000/api/profile \
  -H "Origin: http://localhost:5173"
# Response includes:
# Access-Control-Allow-Origin: http://localhost:5173
# Access-Control-Allow-Credentials: true
During local development you can test authenticated flows using a browser pointed at http://localhost:5173, or via Postman/Insomnia with cookie jars enabled. Direct curl calls also work because curl does not send an Origin header by default and the middleware allows origin-less requests unconditionally.

Build docs developers (and LLMs) love

Get started for freeTalk to us