fix10

backend/cmd/server/main.go

@@ -163,7 +163,8 @@ func withCORS(allowedOrigin string) gin.HandlerFunc {
 
 func originAllowed(origin, configured string) bool {
 	for _, allowed := range strings.Split(configured, ",") {
-		if strings.TrimSpace(allowed) == "*" || strings.TrimSpace(allowed) == origin {
+		allowed = strings.TrimRight(strings.TrimSpace(allowed), "/")
+		if allowed == "*" || allowed == origin {
 			return true
 		}
 	}

backend/internal/config/config.go

@@ -36,7 +36,7 @@ func Load() Config {
 	return Config{
 		DBDriver:              envOrDefault("DB_DRIVER", "postgres"),
 		Port:                  envOrDefault("PORT", "8080"),
-		APIURL:                envOrDefault("API_URL", ""),
+		APIURL:                strings.TrimRight(envOrDefault("API_URL", ""), "/"),
 		DatabaseURL:           envOrDefault("DATABASE_URL", "postgres://surprise:surprise_dev_password@localhost:5432/surprise?sslmode=disable"),
 		SQLitePath:            envOrDefault("SQLITE_PATH", "./data/surprise.db"),
 		CORSOrigin:            envOrDefault("CORS_ORIGIN", "http://localhost:5173,http://127.0.0.1:5173"),