MechaCat02 227b66cb4f docs(env): clarify ADMIN_ALLOWED_ORIGINS fails closed for browsers ...

The comment said an empty value means "CSRF check disabled", but
cookie-authenticated admin mutations fail closed (403) when the
allowlist is empty — which silently blocks enabling the analysis worker
from the browser. Correct the note and add the local-dev hint to set it
to the Vite origin (http://localhost:5173).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-06-28 20:03:30 +02:00

20 KiB

Raw Blame History

View Raw