From d73c0dca8360d0894614e86e8f4963210fb767fc Mon Sep 17 00:00:00 2001
From: Galindo97 <agalindo@aduanasoft.com.mx>
Date: Tue, 12 May 2026 11:17:43 -0500
Subject: [PATCH] fix: add ORIGIN environment variable for SvelteKit to prevent
 internal IP/port usage

---
 docker-compose.prod.yml | 2 ++
 docker-compose.yml      | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml
index 916ce963..ff6e1c53 100644
--- a/docker-compose.prod.yml
+++ b/docker-compose.prod.yml
@@ -365,6 +365,8 @@ services:
       - KEYCLOAK_REALM=${KEYCLOAK_REALM:-master}
       - KEYCLOAK_CLIENT_ID=${KEYCLOAK_CLIENT_ID:-anexo76-backend}
       - KEYCLOAK_CLIENT_SECRET=${KEYCLOAK_CLIENT_SECRET:-dev-secret}
+      # SvelteKit ORIGIN — evita que request.url.origin use la IP/puerto interno del contenedor
+      - ORIGIN=${ORIGIN:-https://anexo76-dev.aduanasoft.com}
     ports:
       - "5111:5173"
     depends_on:
diff --git a/docker-compose.yml b/docker-compose.yml
index 28b35572..b948675a 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -142,6 +142,8 @@ services:
       # CORS / CSRF — trusted origins para svelte.config.js
       - CORS_ORIGINS=${CORS_ORIGINS:-http://localhost:5173,http://localhost:3001}
       - TRUSTED_ORIGINS=${TRUSTED_ORIGINS:-}
+      # SvelteKit ORIGIN — evita que request.url.origin use la IP/puerto interno del contenedor
+      - ORIGIN=${ORIGIN:-http://localhost:5173}
     ports:
       - "5173:5173"
     depends_on: