Fix CORS authentication failures and improve error handling

[Copilot]

Frontend authentication requests (/api/user/auth, /api/user/login, /api/user/google-oauth) blocked by CORS policy. Root cause: missing cookie headers in CORS config and no preflight handling.

Changes

CORS Configuration (server/index.js)

• Dynamic origin validation (handles no-origin requests)
• Added Cookie to allowedHeaders, Set-Cookie to exposedHeaders
• Explicit app.options("*") for preflight requests

const corsOptions = {
    origin: function (origin, callback) {
        const allowedOrigins = ["https://smart-task-manager-sl4a.vercel.app", "http://localhost:5173", "http://localhost:5000"];
        if (!origin || allowedOrigins.indexOf(origin) !== -1) {
            callback(null, true);
        } else {
            callback(new Error("Not allowed by CORS"));
        }
    },
    allowedHeaders: ["Content-Type", "Authorization", "Cookie"],
    exposedHeaders: ["Set-Cookie"],
    preflightContinue: false
};

app.use(cors(corsOptions));
app.options("*", cors(corsOptions));

Error Handling

• Redis error listeners prevent crashes on connection failures
• Global error handler for uncaught errors
• Consistent logger.info/warn/error throughout

Observability

• /health endpoint for monitoring

Documentation

• CORS_FIX_EXPLANATION.md - technical details and troubleshooting
• DEPLOYMENT_GUIDE.md - deployment checklist
• SUMMARY.md - overview

Deployment Note
Requires NODE_ENV=production in Railway for correct cookie settings (secure: true, sameSite: "none").

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
smart-task-manager	Error		Feb 15, 2026 0:51am
smart-task-manager-mfnq	Error		Feb 15, 2026 0:51am
smart-task-manager-sl4a	Ready	Preview, Comment	Feb 15, 2026 0:51am