<?php
// Auto-prepended to every API request so CORS is always sent first (no output before this).
if (!headers_sent()) {
    $origin = $_SERVER['HTTP_ORIGIN'] ?? '';
    $allow = '*';
    if ($origin && (strpos($origin, 'http://localhost') === 0 || strpos($origin, 'http://127.0.0.1') === 0)) {
        $allow = $origin;
    }
    header("Access-Control-Allow-Origin: $allow");
    header('Access-Control-Allow-Methods: GET, POST, OPTIONS');
    header('Access-Control-Allow-Headers: Content-Type, Authorization');
}
