From 3aa504c351d6c88a13cd24321d0043eb1ee95a1c Mon Sep 17 00:00:00 2001
From: Johannes Schmidt <johannes.schmidt42@gmail.com>
Date: Thu, 26 Feb 2026 00:31:00 +0100
Subject: [PATCH] fix cors-config to only allow lawn.video origins

---
 cors-config.json | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/cors-config.json b/cors-config.json
index 360efd9..275ef57 100644
--- a/cors-config.json
+++ b/cors-config.json
@@ -1,10 +1,13 @@
 {
   "CORSRules": [
     {
-      "AllowedOrigins": ["*"],
-      "AllowedMethods": ["GET", "PUT", "POST", "DELETE", "HEAD"],
+      "AllowedOrigins": [
+        "https://lawn.video",
+        "https://www.lawn.video"
+      ],
+      "AllowedMethods": ["GET", "PUT", "HEAD"],
       "AllowedHeaders": ["*"],
-      "ExposeHeaders": ["ETag", "x-amz-request-id", "x-amz-id-2"],
+      "ExposeHeaders": ["ETag"],
       "MaxAgeSeconds": 3600
     }
   ]