fix cors

src/main.ts

@@ -20,7 +20,25 @@ async function bootstrap() {
     }),
   );
 
-  app.enableCors();
+  // CORS configuration: only allow configured frontend origins and enable credentials
+  const allowedOrigins: string[] = [];
+  const frontend = config.get<string>('FRONTEND_URL');
+  const prodFrontend = config.get<string>('PRODUCTION_FRONTEND_URL');
+  if (frontend) allowedOrigins.push(frontend);
+  if (prodFrontend) allowedOrigins.push(prodFrontend);
+
+  app.enableCors({
+    origin: allowedOrigins,
+    credentials: true,
+    methods: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS'],
+    allowedHeaders: [
+      'Content-Type',
+      'Authorization',
+      'Accept',
+      'Origin',
+      'X-Requested-With',
+    ],
+  });
 
   const swaggerEnabled = config.get<string>('SWAGGER_ENABLED') === 'true';