ai_ml_operations/chat_backend
2
0
Fork 0
Code Issues 23 Pull Requests Actions Packages Projects Releases Wiki Activity

Allow Capacitor WebView origins in CORS/CSRF (#22)
CI / test (pull_request) Successful in 10s
Details
Unit Tests / test (pull_request) Successful in 9s
Details

Browse Source 
Merge https://localhost and capacitor://localhost into CORS_ALLOWED_ORIGINS
and CSRF_TRUSTED_ORIGINS so JWT API calls from native shells pass origin
checks without cookie credentials.
This commit is contained in:
westfarn
2026-07-26 15:40:45 -05:00
parent a049e4f685
commit bc2bc115b2
3 changed files with 94 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.env.prod.example
+1
View File
@@ -18,6 +18,7 @@ DJANGO_DEBUG=false
DJANGO_SECRET_KEY=replace-with-a-long-random-secret
DJANGO_ALLOWED_HOSTS=chatbackend.aimloperations.com
# Optional override; when unset, https:// origins are derived from DJANGO_ALLOWED_HOSTS.
# Capacitor WebView origins (https://localhost, capacitor://localhost) are always merged in code.
# DJANGO_CSRF_TRUSTED_ORIGINS=https://chatbackend.aimloperations.com,https://chat.aimloperations.com
CORS_ALLOWED_ORIGINS=https://chat.aimloperations.com
CORS_ORIGIN_ALLOW_ALL=false