some changes to accomodate trusted Cert for Domain name hosting

src/config/config.ts

@@ -1,9 +1,9 @@
 
 export const serverConfig = {
-  exposedUrl: 'http://localhost:4000',
+  exposedUrl: 'https://myapp.local:4000/',
   rpName: 'My App',
-  rpId: 'localhost',
-  origin: 'http://localhost:4200',
+  rpId: 'myapp.local',
+  origin: 'https://myapp.local:4200',
 };
 
 

src/main.ts

@@ -10,31 +10,54 @@ import { ValidationPipe } from '@nestjs/common';
 async function bootstrap() {
   const certsDir = join(__dirname, '..', 'certs');
   const httpsOptions = {
-    key: fs.readFileSync(join(certsDir, 'local-key.pem')),
-    cert: fs.readFileSync(join(certsDir, 'local-cert.pem')),
+    key: fs.readFileSync(join(certsDir, 'myapp.local-key.pem')),
+    cert: fs.readFileSync(join(certsDir, 'myapp.local.pem')),
   };
 
+  // Use HTTPS if needed:
+  const app = await NestFactory.create<NestExpressApplication>(AppModule, {
+    httpsOptions,
+  });
+
+  // HTTP version for LAN testing:
   // const app = await NestFactory.create<NestExpressApplication>(AppModule);
-  // const app = await NestFactory.create<NestExpressApplication>(AppModule, {
-  //   httpsOptions, // <-- Let Nest bind HTTPS
-  // });
 
-  const app = await NestFactory.create<NestExpressApplication>(AppModule);
   app.useGlobalPipes(
     new ValidationPipe({
-      whitelist: true, // strips extra fields
-      forbidNonWhitelisted: true, // rejects unknown fields
-      transform: true, // converts types (e.g. string -> number/date)
+      whitelist: true,
+      forbidNonWhitelisted: true,
+      transform: true,
     }),
   );
 
+  // app.enableCors({
+  //   origin: [
+  //     'http://localhost:4200',        // browser dev
+  //     'capacitor://localhost',        // Capacitor WebView
+  //     'http://192.168.100.80:4200',    // optional LAN Angular dev
+  //   ],
+  //   credentials: true,
+  // });
+
   app.enableCors({
-    origin: 'http://localhost:4200', // your Angular app URL
+    origin: (origin, callback) => {
+      // console.log('CORS origin:', origin); // check what the WebView sends
+      callback(null, true); // allow all origins dynamically
+    },
     credentials: true,
   });
+
   app.setGlobalPrefix('api');
 
-  const angularDistPath = join(__dirname, '..', '..', 'web-app', 'dist', 'mobile-auth-web-app', 'browser');
+  const angularDistPath = join(
+    __dirname,
+    '..',
+    '..',
+    'web-app',
+    'dist',
+    'mobile-auth-web-app',
+    'browser',
+  );
   const indexPath = join(angularDistPath, 'index.html');
 
   app.useStaticAssets(angularDistPath);
@@ -47,15 +70,14 @@ async function bootstrap() {
       resave: false,
       saveUninitialized: false,
       cookie: {
-        httpOnly: true,           // browser can’t access cookie via JS
-        secure: false,            // set true if using HTTPS
-        sameSite: 'lax',          // allow sending cookies cross-origin on localhost
-        maxAge: 24 * 60 * 60 * 1000, // 1 day
+        httpOnly: true,
+        secure: false, // set to true when using HTTPS
+        sameSite: 'lax',
+        maxAge: 24 * 60 * 60 * 1000,
       },
     }),
   );
 
-
   app.use((req, res, next) => {
     const isStaticAsset = req.url.includes('.');
     const isApiCall = req.url.startsWith('/api') || req.method !== 'GET';
@@ -63,8 +85,9 @@ async function bootstrap() {
     res.sendFile(indexPath);
   });
 
+  // Listen on all interfaces so LAN devices can reach it
   await app.listen(4000, '0.0.0.0');
-  console.log(`🚀 HTTPS server running at ${serverConfig.exposedUrl}`);
-
+  console.log(`🚀 HTTP server running at ${serverConfig.exposedUrl}`);
 }
+
 bootstrap();