From 5f8f90636189164bbc38b92f820b6f687a1ea6c8 Mon Sep 17 00:00:00 2001
From: Mark Kunzmann <mark.kunzmann@adintegra.com>
Date: Wed, 6 Aug 2025 11:39:25 +0200
Subject: [PATCH 1/3] feat: Add CORS header

---
 app/next.config.js | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/app/next.config.js b/app/next.config.js
index e938bc2e26..45f9de3834 100644
--- a/app/next.config.js
+++ b/app/next.config.js
@@ -58,6 +58,12 @@ module.exports = withPreconstruct(
           ],
         });
 
+        // Add CORS headers
+        headers[0].headers.push({
+          key: "Access-Control-Allow-Origin",
+          value: "*",
+        });
+
         // See https://content-security-policy.com/ & https://developers.google.com/tag-platform/security/guides/csp
         if (!(process.env.DISABLE_CSP && process.env.DISABLE_CSP === "true")) {
           headers[0].headers.push({

From 55e0540ec90e75f6f053d6f5eb0ccf495bee713c Mon Sep 17 00:00:00 2001
From: Bartosz Prusinowski <bartosz@interactivethings.com>
Date: Fri, 8 Aug 2025 08:55:46 +0200
Subject: [PATCH 2/3] refactor: Only add CORS for .admin.ch domains

---
 app/middleware.ts  | 28 ++++++++++++++++++++++++++++
 app/next.config.js |  6 ------
 2 files changed, 28 insertions(+), 6 deletions(-)
 create mode 100644 app/middleware.ts

diff --git a/app/middleware.ts b/app/middleware.ts
new file mode 100644
index 0000000000..43d3311d2d
--- /dev/null
+++ b/app/middleware.ts
@@ -0,0 +1,28 @@
+import { NextRequest, NextResponse } from "next/server";
+
+export function middleware(request: NextRequest) {
+  const origin = request.headers.get("origin");
+  const response = NextResponse.next();
+
+  if (origin && origin.endsWith(".admin.ch")) {
+    response.headers.set("Access-Control-Allow-Origin", origin);
+    response.headers.set("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
+    response.headers.set(
+      "Access-Control-Allow-Headers",
+      "Content-Type, Authorization"
+    );
+  }
+
+  if (request.method === "OPTIONS") {
+    return new Response(null, {
+      status: 204,
+      headers: response.headers,
+    });
+  }
+
+  return response;
+}
+
+export const config = {
+  matcher: ["/:path*"],
+};
diff --git a/app/next.config.js b/app/next.config.js
index 45f9de3834..e938bc2e26 100644
--- a/app/next.config.js
+++ b/app/next.config.js
@@ -58,12 +58,6 @@ module.exports = withPreconstruct(
           ],
         });
 
-        // Add CORS headers
-        headers[0].headers.push({
-          key: "Access-Control-Allow-Origin",
-          value: "*",
-        });
-
         // See https://content-security-policy.com/ & https://developers.google.com/tag-platform/security/guides/csp
         if (!(process.env.DISABLE_CSP && process.env.DISABLE_CSP === "true")) {
           headers[0].headers.push({

From d5782f9ea7092161fc407339e585e5a9179f0ce1 Mon Sep 17 00:00:00 2001
From: Bartosz Prusinowski <bartosz@interactivethings.com>
Date: Fri, 8 Aug 2025 08:56:44 +0200
Subject: [PATCH 3/3] docs: Update CHANGELOG

---
 CHANGELOG.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index a2836e3465..a75ea01002 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -15,6 +15,8 @@ You can also check the
   - Chart more button is now correctly hidden when there are no actions
     available
   - Most recent value is now correctly resolved in interactive filters
+- Miscellaneous
+  - Added CORS for admin.ch domains
 
 # 5.9.0 - 2025-07-28