From 901f8d3e6f35eb06fd01ce5c7364bc877fd21c89 Mon Sep 17 00:00:00 2001 From: Brendan Ryan Date: Tue, 17 Mar 2026 20:24:58 -0700 Subject: [PATCH] fix: use VERCEL_URL for preview baseUrl to prevent CORS errors MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit VERCEL_BRANCH_URL was used as the baseUrl for preview deployments, which Vocs injects as a tag. When visiting via the deployment-specific URL (e.g. mpp-{hash}-tempoxyz.vercel.app), all relative fetches resolved against the branch URL instead — causing CORS failures on /api/services and RSC requests. This was previously masked by Vercel Deployment Protection (password auth) which canonicalized traffic to the branch URL. After removing password auth, the mismatch is exposed. Fix: prefer VERCEL_URL (matches the visited URL) over VERCEL_BRANCH_URL. --- vocs.config.ts | 2 -- 1 file changed, 2 deletions(-) diff --git a/vocs.config.ts b/vocs.config.ts index 98a3ac66..509b1b00 100644 --- a/vocs.config.ts +++ b/vocs.config.ts @@ -3,8 +3,6 @@ import { defineConfig, McpSource } from "vocs/config"; const baseUrl = (() => { if (process.env.VERCEL_ENV === "production") return `https://${process.env.VERCEL_PROJECT_PRODUCTION_URL}`; - if (process.env.VERCEL_BRANCH_URL) - return `https://${process.env.VERCEL_BRANCH_URL}`; if (process.env.VERCEL_URL) return `https://${process.env.VERCEL_URL}`; if (process.env.NODE_ENV !== "production") return "http://localhost:5173"; return "";