ai_ml_operations/chat_backend
2
0
Fork 0
Code Issues 23 Pull Requests Actions Packages Projects Releases Wiki Activity

Allow Capacitor WebView origins in CORS/CSRF (#22) (#19)
Unit Tests / test (push) Successful in 9s
Details

Browse Source 
## Summary
- Supports [chat_web_app#22](ai_ml_operations/chat_web_app#22)
- Always merge Capacitor WebView origins (`https://localhost`, `capacitor://localhost`, `http://localhost`) into `CORS_ALLOWED_ORIGINS` and `CSRF_TRUSTED_ORIGINS`
- Keep `CORS_ALLOW_CREDENTIALS = False` (JWT header-only; no cookie credentials)

## Test plan
- [x] `uv run python manage.py test chat_backend.tests.test_settings_cors`
- [ ] OPTIONS preflight from `https://localhost` / `capacitor://localhost` against prod/beta with `CORS_ORIGIN_ALLOW_ALL=false`
- [ ] Authenticated JWT GET/POST from Capacitor shell after FE #22 landsReviewed-on: #19
This commit was merged in pull request #19.
This commit is contained in:
westfarn
2026-07-26 14:04:09 -07:00
parent a049e4f685
commit 92aa277a37
3 changed files with 94 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.env.prod.example
+1
View File
@@ -18,6 +18,7 @@ DJANGO_DEBUG=false
DJANGO_SECRET_KEY=replace-with-a-long-random-secret
DJANGO_ALLOWED_HOSTS=chatbackend.aimloperations.com
# Optional override; when unset, https:// origins are derived from DJANGO_ALLOWED_HOSTS.
# Capacitor WebView origins (https://localhost, capacitor://localhost) are always merged in code.
# DJANGO_CSRF_TRUSTED_ORIGINS=https://chatbackend.aimloperations.com,https://chat.aimloperations.com
CORS_ALLOWED_ORIGINS=https://chat.aimloperations.com
CORS_ORIGIN_ALLOW_ALL=false