chris
1a1fe7044a
NPMplus proxy strips the Authorization header before it reaches the backend, causing all write operations to return 401. Switch to a custom X-Admin-Password header which passes through the proxy unmodified. - backend/routes/photos.js: requireAuth checks X-Admin-Password first, falls back to Authorization Bearer for compatibility - backend/server.js: add X-Admin-Password to CORS allowedHeaders - admin/admin.js: send X-Admin-Password instead of Authorization Bearer in all fetch calls and XHR upload requests Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
27 lines
892 B
JavaScript
27 lines
892 B
JavaScript
const express = require('express');
|
|
const cors = require('cors');
|
|
const mongoose = require('mongoose');
|
|
|
|
const app = express();
|
|
const port = process.env.PORT || 5000;
|
|
|
|
app.use(cors({ origin: '*', methods: ['GET', 'POST', 'PUT', 'DELETE'], allowedHeaders: ['Content-Type', 'Authorization', 'X-Admin-Password'] }));
|
|
app.use(express.json());
|
|
app.use('/uploads', express.static('uploads'));
|
|
|
|
// MongoDB Connection
|
|
const uri = process.env.MONGO_URI || 'mongodb://localhost:27017/photogallery';
|
|
mongoose.connect(uri, { useNewUrlParser: true, useUnifiedTopology: true });
|
|
const connection = mongoose.connection;
|
|
connection.once('open', () => {
|
|
console.log("MongoDB database connection established successfully");
|
|
})
|
|
|
|
// API Routes
|
|
const photosRouter = require('./routes/photos');
|
|
app.use('/photos', photosRouter);
|
|
|
|
app.listen(port, () => {
|
|
console.log(`Server is running on port: ${port}`);
|
|
});
|