From 865830071ed86bec9c5eda1b6fc703534702288b Mon Sep 17 00:00:00 2001
From: Peter Hormanns <peter.hormanns@hostsharing.net>
Date: Mon, 10 Nov 2025 18:54:55 +0100
Subject: [PATCH] ph-enable-cors (#210)

permitted HTTP methods explicitly given

Co-authored-by: Peter Hormanns <peter.hormanns@jalin.de>
Reviewed-on: https://dev.hostsharing.net/hostsharing/hs.hsadmin.ng/pulls/210
Reviewed-by: Timotheus Pokorra <timotheus.pokorra@hostsharing.net>
Co-authored-by: Peter Hormanns <peter.hormanns@hostsharing.net>
Co-committed-by: Peter Hormanns <peter.hormanns@hostsharing.net>
---
 .../net/hostsharing/hsadminng/HsadminNgApplication.java     | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/main/java/net/hostsharing/hsadminng/HsadminNgApplication.java b/src/main/java/net/hostsharing/hsadminng/HsadminNgApplication.java
index 0eca06bb..59812797 100644
--- a/src/main/java/net/hostsharing/hsadminng/HsadminNgApplication.java
+++ b/src/main/java/net/hostsharing/hsadminng/HsadminNgApplication.java
@@ -24,9 +24,11 @@ public class HsadminNgApplication {
             	   // TODO: to enable testing, we should use Spring config
                    String allowedOrigins = System.getenv("ALLOWED_ORIGINS");
                    if (allowedOrigins == null || allowedOrigins.length() <= 1) {
-                       allowedOrigins = "*";
+                       allowedOrigins = "/**";
                    }
-                   registry.addMapping("/api/**").allowedOrigins(allowedOrigins);
+                   registry.addMapping("/api/**")
+                   		.allowedOrigins(allowedOrigins)
+                   		.allowedMethods("GET", "PUT", "POST", "PATCH", "DELETE");
                }
            };
        }