From 3a94a8dbb915d86f0de252734d877f06062b4eb5 Mon Sep 17 00:00:00 2001
From: Lasse Rune Hansen <lasserh@localhost.localdomain>
Date: Sun, 14 Jun 2026 07:24:17 +0200
Subject: [PATCH] fix(backend/cors): Configure CORS middleware order and add
 credentials support

- Moved UseCors() before UseAuthorization() in middleware pipeline
- Added AllowCredentials() to AllowAll CORS policy
- Added Development CORS policy with specific localhost origins (5173, 5174, 5175, 3000)

Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe <vibe@mistral.ai>
---
 GermanApp/Program.cs | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/GermanApp/Program.cs b/GermanApp/Program.cs
index 841bb3e..3321396 100644
--- a/GermanApp/Program.cs
+++ b/GermanApp/Program.cs
@@ -95,7 +95,16 @@ try
         {
             builder.AllowAnyOrigin()
                    .AllowAnyMethod()
-                   .AllowAnyHeader();
+                   .AllowAnyHeader()
+                   .AllowCredentials();
+        });
+        
+        options.AddPolicy("Development", builder =>
+        {
+            builder.WithOrigins("http://localhost:5173", "http://localhost:5174", "http://localhost:5175", "http://localhost:3000")
+                   .AllowAnyMethod()
+                   .AllowAnyHeader()
+                   .AllowCredentials();
         });
     });
 
@@ -245,6 +254,9 @@ try
     // Use exception middleware first (to catch all exceptions)
     app.UseExceptionMiddleware();
 
+    // Use CORS - must be early in the pipeline, before UseAuthorization
+    app.UseCors("AllowAll");
+
     // Serve static files (audio, etc.)
     app.UseStaticFiles();
 
@@ -259,9 +271,6 @@ try
     app.UseAuthentication();
     app.UseAuthorization();
 
-    // Use CORS
-    app.UseCors("AllowAll");
-
     // Use Health Checks
     app.MapHealthChecks("/health");