Configure CORS headers from environment variables

server/.env.example

@@ -39,6 +39,28 @@ TURN_TIMEOUT_SECONDS=30
 # schema). Unset logs DEBUG to the console.
 #LOGGING_CONFIG=/path/to/logging.yaml
 
+# CORS (via kaya-cors' CorsMixin; same semantics as Starlette's
+# CORSMiddleware). Disabled unless CORS_ALLOW_ORIGINS or
+# CORS_ALLOW_ORIGIN_REGEX is set — the app serves the SPA and the API from
+# the same origin, so no CORS headers are needed by default.
+# Comma-separated list of origins allowed to make cross-origin requests,
+# or "*" for any origin:
+#CORS_ALLOW_ORIGINS=https://example.com,https://app.example.com
+# Optional regex (fullmatch) allowed origins are additionally checked
+# against — handy for dynamic preview URLs:
+#CORS_ALLOW_ORIGIN_REGEX=https://tavolo-[a-z0-9-]+\.vercel\.app
+# Comma-separated allowed methods, or "*" for all (default GET):
+#CORS_ALLOW_METHODS=GET,POST
+# Comma-separated allowed request headers, or "*" to mirror back whatever
+# the browser requests (default: only the CORS-safelisted headers):
+#CORS_ALLOW_HEADERS=Authorization,Content-Type
+# Allow cookies/credentials on cross-origin requests (1/true/yes/on):
+#CORS_ALLOW_CREDENTIALS=false
+# Comma-separated response headers exposed to the browser:
+#CORS_EXPOSE_HEADERS=
+# Seconds browsers may cache the preflight response (default 600):
+#CORS_MAX_AGE=600
+
 # App server
 APP_HOST=0.0.0.0
 APP_PORT=8080