Summary
The DailyForge backend has its CORS origin hardcoded to the production Render frontend URL in backend/src/server.js. The README itself acknowledges this by asking every contributor to manually change the CORS origin before running locally. This is a significant developer experience gap — every new contributor must remember to make this change and, critically, must never accidentally commit it back to main.
Problem
From the README:
⚠️ Local dev note: The backend CORS origin is currently configured for the deployed frontend. When running the frontend locally on http://localhost:5173, update the CORS origin temporarily for local development.
This means:
- Every contributor must manually edit
backend/src/server.js before running locally
- There is a high chance of a contributor accidentally committing the local
origin: "http://localhost:5173" change and breaking the production app for other users
- The
.env system is already in place for other variables but is not used here, creating an inconsistency
- New GSSoC contributors who miss this note will spend time debugging mysterious CORS errors
Impact
- Every contributor faces a broken local setup until they find and apply the manual fix
- Production CORS misconfiguration risk via accidental commit
- Inconsistent use of environment variables undermines the project's own conventions
Proposed Solution
Move the CORS origin to an environment variable so it works correctly in both local and production environments without any manual edits to source files:
In backend/.env.example (add this line):
FRONTEND_ORIGIN=http://localhost:5173
In production Render settings (as an environment variable):
FRONTEND_ORIGIN=https://dailyforge-frontend-lhjq.onrender.com/
In backend/src/server.js:
// Before
origin: "https://dailyforge-frontend-lhjq.onrender.com"
// After
origin: process.env.FRONTEND_ORIGIN || "http://localhost:5173"
This single change eliminates the manual step for every contributor and removes the risk of accidentally committing a broken CORS origin. I will also update the README to remove the manual-edit warning and replace it with the environment variable instruction.
I am ready to implement this immediately. Please assign this issue to me.
Labels: bug, developer-experience, help wanted, GSSoC 2026
Summary
The DailyForge backend has its CORS
originhardcoded to the production Render frontend URL inbackend/src/server.js. The README itself acknowledges this by asking every contributor to manually change the CORS origin before running locally. This is a significant developer experience gap — every new contributor must remember to make this change and, critically, must never accidentally commit it back tomain.Problem
From the README:
This means:
backend/src/server.jsbefore running locallyorigin: "http://localhost:5173"change and breaking the production app for other users.envsystem is already in place for other variables but is not used here, creating an inconsistencyImpact
Proposed Solution
Move the CORS origin to an environment variable so it works correctly in both local and production environments without any manual edits to source files:
In
backend/.env.example(add this line):In production Render settings (as an environment variable):
FRONTEND_ORIGIN=https://dailyforge-frontend-lhjq.onrender.com/
In
backend/src/server.js:This single change eliminates the manual step for every contributor and removes the risk of accidentally committing a broken CORS origin. I will also update the README to remove the manual-edit warning and replace it with the environment variable instruction.
I am ready to implement this immediately. Please assign this issue to me.
Labels:
bug,developer-experience,help wanted,GSSoC 2026