Fix CORS to use CLIENT_URL environment variable

[railway-app]

Problem

The CORS middleware in cors.go had the frontend URL hardcoded as https://scintillating-commitment-production-2429.up.railway.app/, causing CORS errors whenever the frontend URL changed or differed across environments. main.go was already calling corsmiddleware.CORS(mux, url) with the CLIENT_URL env var, but the function signature only accepted next http.Handler, so the code wouldn't compile and the env var was never used.

Solution

Updated CORS in cors.go to accept a second clientURL string parameter and use it for the Access-Control-Allow-Origin header, removing the hardcoded URL. This aligns the function signature with the existing call in main.go, so the origin is now driven entirely by the CLIENT_URL environment variable.

Changes

• Modified backend/internal/middleware/cors/cors.go

---

Generated by Railway