Update backend/middleware/middleware.go

backend/middleware/middleware.go

@@ -2,6 +2,7 @@ package middleware
 
 import (
 	"log"
+	"os"
 	"time"
 
 	"github.com/gofiber/fiber/v2"
@@ -12,10 +13,19 @@ import (
 func SetupMiddleware(app *fiber.App) {
 	app.Use(recover.New())
 
+	// Read allowed origins from env — set ALLOWED_ORIGINS on HuggingFace to your Render frontend URL
+	// e.g. ALLOWED_ORIGINS=https://creepurl.onrender.com
+	// Defaults to * (all origins) so it works out of the box
+	allowedOrigins := os.Getenv("ALLOWED_ORIGINS")
+	if allowedOrigins == "" {
+		allowedOrigins = "*"
+	}
+
 	app.Use(cors.New(cors.Config{
-		AllowOrigins: "*",
+		AllowOrigins: allowedOrigins,
 		AllowMethods: "GET,POST,OPTIONS",
-		AllowHeaders: "Content-Type,Authorization",
+		AllowHeaders: "Content-Type,Authorization,Accept",
+		MaxAge:       300,
 	}))
 
 	app.Use(requestLogger)