Same-origin requests don't need CORS restrictions. Users can optionally set ALLOWED_ORIGINS to lock it down.
Self-hosted travel planner with Express.js, SQLite, React & Tailwind CSS.