The "Adding CORS Headers" section in the coordinator README has a typo that'll actually trip people up.
The Host Locally section says you visit http://localhost:5173 after running npm run dev:coordinator — that's correct. But a few paragraphs down, the CORS setup instructions tell you to set:
Access-Control-Allow-Origin: https://localhost:5137
Two problems here: it's 5137 instead of 5173, and it says https when the dev server actually runs plain http.
I checked this isn't just a doc slip that doesn't matter in practice — I cloned main, ran npm install, and started the coordinator with npx vite:
VITE v6.4.2 ready in 2282 ms
➜ Local: http://localhost:5173/
No custom port or https is set in vite.config.ts, so that's the real address. Since CORS checks match origin exactly (scheme + host + port), if you copy-paste the header as written, your bitcoind node will still reject requests from Caravan — you'll just be stuck wondering why CORS is "still broken" even after following the docs.
This is also the exact section the README calls out as "essential to protecting the security of your coins," so it's not a great place to have a copy-paste trap.
Fix is simple — line 207 should read:
Access-Control-Allow-Origin: http://localhost:5173
(or word it more generally so it doesn't go stale again, like "match the origin your dev server prints, usually http://localhost:5173")
This only touches the README, not any transaction/PSBT code, so I don't think it needs a changeset — but happy to add one if maintainers want it anyway.
The "Adding CORS Headers" section in the coordinator README has a typo that'll actually trip people up.
The Host Locally section says you visit
http://localhost:5173after runningnpm run dev:coordinator— that's correct. But a few paragraphs down, the CORS setup instructions tell you to set:Access-Control-Allow-Origin: https://localhost:5137Two problems here: it's
5137instead of5173, and it sayshttpswhen the dev server actually runs plainhttp.I checked this isn't just a doc slip that doesn't matter in practice — I cloned main, ran
npm install, and started the coordinator withnpx vite:VITE v6.4.2 ready in 2282 ms
➜ Local: http://localhost:5173/
No custom port or https is set in
vite.config.ts, so that's the real address. Since CORS checks match origin exactly (scheme + host + port), if you copy-paste the header as written, your bitcoind node will still reject requests from Caravan — you'll just be stuck wondering why CORS is "still broken" even after following the docs.This is also the exact section the README calls out as "essential to protecting the security of your coins," so it's not a great place to have a copy-paste trap.
Fix is simple — line 207 should read:
Access-Control-Allow-Origin: http://localhost:5173(or word it more generally so it doesn't go stale again, like "match the origin your dev server prints, usually
http://localhost:5173")This only touches the README, not any transaction/PSBT code, so I don't think it needs a changeset — but happy to add one if maintainers want it anyway.