refactor: update API base URL handling to support same-origin requests and enhance auth cookie management

2026-05-20 00:30:25 +01:00
parent bad837a4cb
commit ae36b87c16
2 changed files with 9 additions and 3 deletions
@@ -16,7 +16,10 @@ export const getRequestBaseUrl = () => {
    return process.env.PRIVATE_SERVER_URL || env.PUBLIC_SERVER_URL;
  }

-  return env.PUBLIC_SERVER_URL;
+  // Browser: same-origin via the Cloudflare Worker /api proxy. Keeps auth
+  // cookies host-only on whichever domain the user is currently visiting
+  // (app.classroomio.com, <org>.classroomio.school, or a BYOD domain).
+  return `${window.location.origin}/api`;
 };

 function mergeAbortSignals(...signals: Array<AbortSignal | null | undefined>) {