diff options
| author | Paul Buetow <paul@buetow.org> | 2026-05-17 21:13:47 +0300 |
|---|---|---|
| committer | Paul Buetow <paul@buetow.org> | 2026-05-17 21:13:47 +0300 |
| commit | 27562eaf12a112d46986a4e8ec3dfcc342ae4738 (patch) | |
| tree | 431799065bf854203fea5092114fbdf3e8e5c14c /player-server/AGENTS.md | |
| parent | a91f271c210938b5817eafbe434d9d2681f0cc0a (diff) | |
Add CORS middleware for multi-origin clients
Diffstat (limited to 'player-server/AGENTS.md')
| -rw-r--r-- | player-server/AGENTS.md | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/player-server/AGENTS.md b/player-server/AGENTS.md index db60e36..07daee0 100644 --- a/player-server/AGENTS.md +++ b/player-server/AGENTS.md @@ -197,6 +197,7 @@ This triggers `FSScanner.Scan()`, which: | `MEDIA_PAGE_SIZE` | `100` | ≥ 1 | Items displayed per thumbnail grid page | | `LOG_LEVEL` | `info` | `debug` / `info` / `warn` / `error` | Log verbosity | | `SECURE_COOKIES` | `true` | `true` / `false` | Set `Secure` flag on session cookies; set to `false` for plain-HTTP local deployments | +| `PLAYER_CORS_ORIGINS` | unset | comma-separated origins | Allowed browser origins for credentialed CORS requests; unset/empty emits no CORS headers | **Important:** The K8s `Deployment` overrides `DB_PATH` to `/data/media.db` and `MEDIA_ROOT` to `/media` so the PVC mounts are used. Do not rely on the local defaults in a container. |