From 227b66cb4fc21926d05fb1a374f553d67f12b48e Mon Sep 17 00:00:00 2001 From: MechaCat02 Date: Sun, 28 Jun 2026 20:03:30 +0200 Subject: [PATCH] docs(env): clarify ADMIN_ALLOWED_ORIGINS fails closed for browsers MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The comment said an empty value means "CSRF check disabled", but cookie-authenticated admin mutations fail closed (403) when the allowlist is empty — which silently blocks enabling the analysis worker from the browser. Correct the note and add the local-dev hint to set it to the Vite origin (http://localhost:5173). Co-Authored-By: Claude Opus 4.8 --- .env.example | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/.env.example b/.env.example index 01f8079..c4be0aa 100644 --- a/.env.example +++ b/.env.example @@ -62,11 +62,16 @@ CORS_ALLOWED_ORIGINS= # neither Origin nor Referer (curl, server-to-server callers) are # always allowed. # -# Default is empty: CSRF check disabled (operator opt-out). For a -# browser-exposed deployment this should be set to the SvelteKit -# origin, e.g. https://app.example.com. For a same-origin -# docker-compose deploy where only one origin exists, set the same -# value the browser uses. +# Empty does NOT mean "off" for browsers: cookie-authenticated admin +# mutations FAIL CLOSED (403) when this is empty, since there's no +# allowlist to check the Origin against. Non-cookie callers (curl, +# bots with a Bearer token, no Origin/Referer) are still allowed. +# So set this to the SvelteKit origin for any browser-exposed deploy, +# e.g. https://app.example.com. For a same-origin docker-compose deploy +# set the same value the browser uses. +# Local dev (native `npm run dev`): the Vite origin is +# http://localhost:5173 — set ADMIN_ALLOWED_ORIGINS=http://localhost:5173 +# or admin toggles (e.g. enabling the analysis worker) return 403. ADMIN_ALLOWED_ORIGINS= # ----- Admin bootstrap -----