Fix CORS/PNA loopback blocking for /api/auth/me from deployed frontend

[Honey-pg]

Bug Description

Frontend requests to http://localhost:5000/api/auth/me are failing when the app is served from https://dailyforge-frontend-lhjq.onrender.com.

Browser console shows:

• Access to XMLHttpRequest at 'http://localhost:5000/api/auth/me' from origin 'https://dailyforge-frontend-lhjq.onrender.com' has been blocked by CORS policy: Permission was denied for this request to access the loopback address space.
• GET http://localhost:5000/api/auth/me net::ERR_FAILED
• Network error. Please check your connection.

This appears to be caused by Private Network Access (PNA) preflight restrictions when a public origin calls a localhost backend.

Steps to Reproduce

1. Open the deployed frontend at https://dailyforge-frontend-lhjq.onrender.com.
2. Trigger auth/session fetch that calls GET /api/auth/me.
3. Inspect browser console/network tab.
4. Observe failed request to http://localhost:5000/api/auth/me and CORS/PNA denial.

Expected Behavior

Auth endpoint request should succeed (or fail with a normal API auth response), without browser-level CORS/PNA blocking.

Actual Behavior

Request is blocked by browser before successful API communication due to CORS/PNA policy.

Probable Root Cause

• Frontend is configured to call a localhost API from a public domain.
• Backend likely does not return required preflight headers for private network requests.

Suggested Fix

• Avoid using localhost as API base URL for publicly hosted frontend builds.
• Point frontend to a publicly hosted backend URL (staging/production API).
• For development/testing where this flow is necessary, update backend CORS handling to support preflight correctly, including Access-Control-Allow-Private-Network: true when access-control-request-private-network is present.

Example (Express):

const express = require('express');
const cors = require('cors');
const app = express();

app.use(cors({
  origin: 'https://dailyforge-frontend-lhjq.onrender.com',
  credentials: true,
}));

app.use((req, res, next) => {
  if (req.headers['access-control-request-private-network']) {
    res.setHeader('Access-Control-Allow-Private-Network', 'true');
  }
  next();
});

Acceptance Criteria

• Requests from deployed frontend no longer target localhost in non-local environments.
• GET /api/auth/me succeeds from deployed frontend with correct CORS behavior.
• No loopback address space CORS/PNA errors appear in browser console for auth flow.

Additional Context

Error trace references bundled frontend file:

• index-2aqmWhIF.js

If helpful, we can also add an environment-guard check to fail fast when localhost API URLs are used in production frontend builds.

[Honey-pg]

/assign it to me under gssoc'26.

[github-actions]

Hi @Honey-pg, please wait 6h before claiming this issue again (cooldown active).

[controlcoder]

/claim

[github-actions]

Hi @controlcoder, please wait 6h before claiming this issue again (cooldown active).

[controlcoder]

/assign

[github-actions]

Hi @controlcoder, please wait 6h before claiming this issue again (cooldown active).

[aaniya22]

pls assign this to me under gssoc

[Bhavy12-cell]

Hi @Honey-pg
Please assign me this issue.