dextmorgn ee06d6cf3e fix(api): restrict CORS origins via ALLOWED_ORIGINS env ...

allow_origins was ["*"] together with allow_credentials=True, which is
both insecure and rejected by browsers for credentialed requests. Read a
comma-separated ALLOWED_ORIGINS env var instead, defaulting to the Vite
dev origin http://localhost:5173. Documented in .env.example.

2026-05-30 18:49:44 +02:00

..

api

fix(api): load AUTH_SECRET from validated core.auth source

2026-05-30 18:44:07 +02:00

security

…

utils

…

__init__.py

…

main.py

fix(api): restrict CORS origins via ALLOWED_ORIGINS env

2026-05-30 18:49:44 +02:00

utils.py

…