change cors error

src/server.js

@@ -1,6 +1,6 @@
 require('dotenv').config();
 // import uploadRoutes from "./routes/upload.routes";
-const uploadRoutes = require("./routes/upload.routes");
+const uploadRoutes = require('./routes/upload.routes');
 
 const express = require('express');
 const cors = require('cors');
@@ -25,14 +25,22 @@ app.use(
   })
 );
 
-// CORS configuration
+// CORS configuration (ONLY from .env)
+const allowedOrigins = process.env.CORS_ORIGIN
+  ? process.env.CORS_ORIGIN.split(',').map(origin => origin.trim())
+  : [];
+
 const corsOptions = {
-  origin: process.env.CORS_ORIGIN?.split(',') || [
+  origin: function (origin, callback) {
-    'http://localhost:3000',
+    // Allow requests with no origin (like Postman, mobile apps)
-    'http://localhost:3001',
+    if (!origin) return callback(null, true);
-    'http://localhost:5173',
+
-    'http://localhost:5174',
+    if (allowedOrigins.includes(origin)) {
-  ],
+      callback(null, true);
+    } else {
+      callback(new Error('Not allowed by CORS'));
+    }
+  },
   credentials: true,
   methods: ['GET', 'POST', 'PUT', 'DELETE', 'PATCH', 'OPTIONS'],
   allowedHeaders: ['Content-Type', 'Authorization', 'X-Requested-With'],
@@ -73,8 +81,7 @@ app.use('/api/admin', require('./routes/admin'));
 app.use('/api/admin/reports', require('./routes/reports'));
 app.use('/api/payments', require('./routes/paymentRoutes'));
 // Upload route
-app.use("/api", uploadRoutes);
+app.use('/api', uploadRoutes);
-
 
 // Root endpoint
 app.get('/', (req, res) => {