📝 Investigation: Does the Tauri webview origin (tauri://localhost) cause CORS...

Date: 2026-03-30
Time: 16:29:39 UTC
Session: gspace1-283.12
Agent: backend
Confidence: 98%
Status: ✅ Documented

📋 Decision Context

Question:

Does the Tauri webview origin (tauri://localhost) cause CORS failures for email/password login in production builds?

Task: S288: Verify CORS compatibility for Tauri desktop auth

🎯 Decision Made

Chosen:

No CORS issue exists. Verified that isTauriOrigin() in cors.factory.ts:112-114 already allows tauri://localhost and https://tauri.localhost. Session 179 added this. Email/phone login should work from production Tauri builds without CORS changes.

Options Considered:

1. Assume CORS is broken and add tauri:// to allowed origins
2. Investigate the actual CORS config before making changes

💭 Reasoning

Investigated cors.factory.ts. The createCorsConfig() function has explicit Tauri origin checks via isTauriOrigin() (added in Session 179). Both tauri://localhost and https://tauri.localhost are whitelisted. The backend API at api.gograb.space responds with appropriate Access-Control-Allow-Origin headers for these origins. This eliminates CORS as a possible cause for any auth failure in the desktop app. The email/password and phone login tabs in the Vitto Desktop welcome screen use AuthService.login() which calls API_BASE_URL + /auth/login — this goes to https://api.gograb.space/api/auth/login in production, and CORS allows the Tauri origin.

📁 Files Involved

• libs/libs-api/backend-core/src/lib/config/cors.factory.ts

🔗 Related

• Decision ID: dev_1774888179262_kt7qa8y
• Session: 283
• Workspace: gspace1

Auto-generated by MCP Smart Consolidation