From eed129347bd0826952d0f34e30c2da0a462dcaaa Mon Sep 17 00:00:00 2001
From: Paul Bailey <psbailey31@gmail.com>
Date: Tue, 18 Nov 2025 01:12:45 +0000
Subject: [PATCH] fix: Disable crossOriginResourcePolicy in helmet to allow
 image loading

- Images exist on server but helmet was blocking cross-origin access
- Disable crossOriginResourcePolicy to allow images to load from https://litter-api.psbailey.uk
- Frontend at https://litterscouts.psbailey.uk can now load images from API domain
---
 server/src/index.ts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/server/src/index.ts b/server/src/index.ts
index 76684f7..d1842af 100644
--- a/server/src/index.ts
+++ b/server/src/index.ts
@@ -19,8 +19,8 @@ const PORT = process.env.PORT || 3005;
 
 // Middleware
 app.use(helmet({
-  crossOriginResourcePolicy: { policy: "cross-origin" },
-  contentSecurityPolicy: false, // Disable CSP for development
+  crossOriginResourcePolicy: false, // Disable to allow images to be loaded from different origin
+  contentSecurityPolicy: false,
 }));
 app.use(cors({
   origin: [