Latest Updated Pages

src/pages/api/contact.ts

@@ -190,21 +190,35 @@ function escapeHtml(str: string): string {
 // ============================================================
 // CORS headers helper
 // ============================================================
-function corsHeaders(): HeadersInit {
-  const origin = import.meta.env.PROD ? 'https://workroot.in' : '*';
+const ALLOWED_ORIGINS = ['https://workroot.in', 'https://www.workroot.in'];
+
+function corsHeaders(requestOrigin?: string | null): HeadersInit {
+  if (!import.meta.env.PROD) {
+    return {
+      'Content-Type': 'application/json',
+      'Access-Control-Allow-Origin': '*',
+      'Access-Control-Allow-Methods': 'POST, OPTIONS',
+      'Access-Control-Allow-Headers': 'Content-Type',
+    };
+  }
+  // Reflect the request origin if it is in the allowlist, otherwise default to primary domain
+  const origin = requestOrigin && ALLOWED_ORIGINS.includes(requestOrigin)
+    ? requestOrigin
+    : 'https://workroot.in';
   return {
     'Content-Type': 'application/json',
     'Access-Control-Allow-Origin': origin,
     'Access-Control-Allow-Methods': 'POST, OPTIONS',
     'Access-Control-Allow-Headers': 'Content-Type',
+    'Vary': 'Origin',
   };
 }
 
 // ============================================================
 // OPTIONS preflight handler
 // ============================================================
-export const OPTIONS: APIRoute = async () => {
-  return new Response(null, { status: 204, headers: corsHeaders() });
+export const OPTIONS: APIRoute = async ({ request }) => {
+  return new Response(null, { status: 204, headers: corsHeaders(request.headers.get('origin')) });
 };
 
 // ============================================================
@@ -213,11 +227,12 @@ export const OPTIONS: APIRoute = async () => {
 export const POST: APIRoute = async ({ request, clientAddress }) => {
   const ip = clientAddress ?? 'unknown';
   const startTime = Date.now();
+  const requestOrigin = request.headers.get('origin');
 
   // Rate limiting check
   const rateLimit = checkRateLimit(ip);
   const rateLimitHeaders = {
-    ...corsHeaders(),
+    ...corsHeaders(requestOrigin),
     'X-RateLimit-Limit': String(RATE_LIMIT_MAX_REQUESTS),
     'X-RateLimit-Remaining': String(rateLimit.remaining),
     'X-RateLimit-Reset': String(Math.ceil(rateLimit.resetAt / 1000)),