Origins, cookies, and CORS
Exact origin allowlist
ALLOWED_ORIGINS is a comma-separated list of exact origins, trimmed on each item, with empty values removed. Defaults are https://app.ngamia.com,http://localhost:4174. An origin includes scheme, host, and port, and has no trailing path. https://app.ngamia.com and https://www.app.ngamia.com are different values.
Auth and dedicated Music controller routes reject a missing or unlisted origin with 403 and { "error": { "message": "..." } }. Health is the exception: /api/health does not inspect the request origin. The Express proxy rejects a present but unlisted Origin, but permits requests without an Origin header. Global CORS controls browser access; it does not prevent non-browser clients from reaching the proxy directly.
Credentialed CORS headers
Nest’s Express CORS middleware enables credentials, declares GET, POST, PATCH, DELETE, OPTIONS, accepts Content-Type and Idempotency-Key, and exposes Content-Disposition, X-Generation-Id, X-Music-Creation-Id, X-Request-Id, and Retry-After to browser code. For configured origins, the middleware reflects the matching origin. Authorization is not an allowed browser request header: the browser uses cookies and the API attaches the bearer token server-side.
The CORS middleware answers browser preflight for the declared methods and headers. Set credentials: 'include' in fetch; without it, the browser does not send or accept cross-origin session cookies. Auth and Music controllers also require a non-empty allowed Origin on the actual request.
Cookie attributes
Both session cookies are HttpOnly, SameSite=Lax, and scoped to /. Secure is enabled in production. If web and API use different registrable domains, browser third-party cookie policies may interfere; deploy under compatible same-site domains or same-origin routing and validate on real browsers. This service does not configure a custom cookie domain.
Configure an environment
Local app origin: http://localhost:4174. Production app origin: https://app.ngamia.com. Set only the origins that should call the API. Do not use *; credentials cannot be safely paired with a wildcard and the implementation uses explicit matching.
See configuration for the complete variable inventory.