Always merge Capacitor WebView origins (https://localhost, capacitor://localhost, http://localhost) into CORS_ALLOWED_ORIGINS and CSRF_TRUSTED_ORIGINS
Keep CORS_ALLOW_CREDENTIALS = False (JWT header-only; no cookie credentials)
Test plan
uv run python manage.py test chat_backend.tests.test_settings_cors
OPTIONS preflight from https://localhost / capacitor://localhost against prod/beta with CORS_ORIGIN_ALLOW_ALL=false
Authenticated JWT GET/POST from Capacitor shell after FE #22 lands
## Summary
- Supports [chat_web_app#22](https://git.aimloperations.com/ai_ml_operations/chat_web_app/issues/22)
- Always merge Capacitor WebView origins (`https://localhost`, `capacitor://localhost`, `http://localhost`) into `CORS_ALLOWED_ORIGINS` and `CSRF_TRUSTED_ORIGINS`
- Keep `CORS_ALLOW_CREDENTIALS = False` (JWT header-only; no cookie credentials)
## Test plan
- [x] `uv run python manage.py test chat_backend.tests.test_settings_cors`
- [ ] OPTIONS preflight from `https://localhost` / `capacitor://localhost` against prod/beta with `CORS_ORIGIN_ALLOW_ALL=false`
- [ ] Authenticated JWT GET/POST from Capacitor shell after FE #22 lands
Merge https://localhost and capacitor://localhost into CORS_ALLOWED_ORIGINS
and CSRF_TRUSTED_ORIGINS so JWT API calls from native shells pass origin
checks without cookie credentials.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Summary
https://localhost,capacitor://localhost,http://localhost) intoCORS_ALLOWED_ORIGINSandCSRF_TRUSTED_ORIGINSCORS_ALLOW_CREDENTIALS = False(JWT header-only; no cookie credentials)Test plan
uv run python manage.py test chat_backend.tests.test_settings_corshttps://localhost/capacitor://localhostagainst prod/beta withCORS_ORIGIN_ALLOW_ALL=false