CORS Deployment Configuration

Architecture

CORS is configured via a two-layer model applied identically to every stack:

1. CDK_DOMAIN_NAME → auto-applied as https://{value} (always)
2. CDK_CORS_ORIGINS → additional global origins (optional, comma-separated)
3. Per-section CDK_*_CORS_ORIGINS → stack-specific extras (optional)

localhost is NEVER auto-included. Use CDK_CORS_ORIGINS=http://localhost:4200 for local dev.

The Helper

Every stack uses buildCorsOrigins(config, additionalOrigins?) from infrastructure/lib/config.ts. This returns a deduplicated string[].

// Container env var (Fargate / AgentCore Runtime)
CORS_ORIGINS: buildCorsOrigins(config, config.appApi.additionalCorsOrigins).join(','),