Configure CORS headers from environment variables

2026-09-18 19:18:27 +08:00
parent e2091ee4df
commit e0896b4a95
10 changed files with 313 additions and 5 deletions
@@ -61,6 +61,16 @@ data:
  GAME_TTL_SECONDS: "86400"
  HAND_ACK_TIMEOUT_SECONDS: "30"
  TURN_TIMEOUT_SECONDS: "30"
+  # CORS (kaya-cors' CorsMixin). Disabled unless CORS_ALLOW_ORIGINS or
+  # CORS_ALLOW_ORIGIN_REGEX is set — unneeded when the SPA and the API are
+  # served from the same origin. See server/.env.example for details.
+  # CORS_ALLOW_ORIGINS: "https://example.com,https://app.example.com"  # or "*"
+  # CORS_ALLOW_ORIGIN_REGEX: 'https://tavolo-[a-z0-9-]+\.vercel\.app'
+  # CORS_ALLOW_METHODS: "GET,POST"              # default: GET; "*" = all
+  # CORS_ALLOW_HEADERS: "Authorization,Content-Type"  # "*" mirrors the request
+  # CORS_ALLOW_CREDENTIALS: "false"
+  # CORS_EXPOSE_HEADERS: ""
+  # CORS_MAX_AGE: "600"
  # OIDC (provider lives in another namespace).
  OIDC_CLIENT_ID: tavolo
  OIDC_POST_LOGIN_REDIRECT: /