fix(config): make CORS origins overridable by environment

2026-08-15 15:30:33 +05:30
parent 2cb7d3b14a
commit 053a1cee05
1 changed files with 5 additions and 2 deletions
@@ -34,8 +34,11 @@ jwt.secret=${UDYAM_JWT_SECRET:55647961_6D4C_696E_6320_4E41_4241_5244_5F32_3032_3
 # 24 hours
 jwt.expiration=86400000

-# The Vite dev server for UdyamLinc-UI (5180 is BharatLinc)
-udyam.cors.allowed-origins=http://localhost:5182,http://127.0.0.1:5182,http://localhost:4173
+# The Vite dev server for UdyamLinc-UI (5180 is BharatLinc). A deployment must
+# add its own UI origin via UDYAM_CORS_ALLOWED_ORIGINS — this list is exhaustive,
+# so an origin missing from it fails in the browser as an opaque network error
+# with a healthy-looking backend behind it.
+udyam.cors.allowed-origins=${UDYAM_CORS_ALLOWED_ORIGINS:http://localhost:5182,http://127.0.0.1:5182,http://localhost:4173}

 # Forecast horizon in months — the deck's 3–6 month early-warning window
 udyam.forecast.horizon-months=6