From 27562eaf12a112d46986a4e8ec3dfcc342ae4738 Mon Sep 17 00:00:00 2001 From: Paul Buetow Date: Sun, 17 May 2026 21:13:47 +0300 Subject: Add CORS middleware for multi-origin clients --- player-server/docs/configuration.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'player-server/docs') diff --git a/player-server/docs/configuration.md b/player-server/docs/configuration.md index 60d6ad6..edd2b93 100644 --- a/player-server/docs/configuration.md +++ b/player-server/docs/configuration.md @@ -15,5 +15,6 @@ All settings are environment variables. Unset variables use defaults. | `PODCAST_CHECK_INTERVAL_MINUTES` | `60` | ≥ 1 | Podcast feed refresh interval | | `LOG_LEVEL` | `info` | `debug` / `info` / `warn` / `error` | Log verbosity | | `SECURE_COOKIES` | `true` | `true` / `false` | Set `Secure` flag on session cookies; set to `false` for plain-HTTP local deployments | +| `PLAYER_CORS_ORIGINS` | unset | comma-separated origins | Allowed browser origins for credentialed CORS requests; unset/empty emits no CORS headers | -**Important:** The K8s `Deployment` overrides `DB_PATH` to `/data/media.db` and `MEDIA_ROOT` to `/media` so the PVC mounts are used. Do not rely on the local defaults in a container. \ No newline at end of file +**Important:** The K8s `Deployment` overrides `DB_PATH` to `/data/media.db` and `MEDIA_ROOT` to `/media` so the PVC mounts are used. Do not rely on the local defaults in a container. -- cgit v1.2.3