CORS headers are only needed in development

in production the API isn't called directly from the browser, but through the PDS proxy

app/server.rb

···
 
   before do
     @authenticator = Authenticator.new(hostname: HOSTNAME)
+
+    if settings.development?
+      headers['Access-Control-Allow-Origin'] = '*'
+    end
   end
 
   get '/xrpc/blue.feeds.lycan.searchPosts' do
-    headers['access-control-allow-origin'] = '*'
-
     @user = load_user
 
     if params[:query].to_s.strip.empty?
···
   end
 
   post '/xrpc/blue.feeds.lycan.startImport' do
-    headers['access-control-allow-origin'] = '*'
-
     did = get_user_did
     user = User.find_or_create_by(did: did)
 
···
   end
 
   get '/xrpc/blue.feeds.lycan.getImportStatus' do
-    headers['access-control-allow-origin'] = '*'
-
     did = get_user_did
     user = User.find_by(did: did)
     until_date = user&.imported_until