CooperandGoodman/homeschool
1
0
Fork 0
Code Issues Pull Requests Activity

Clarify CORS_ORIGINS config in README with reverse proxy warning

Browse Source 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Derek Cooper
2026-03-10 22:39:59 -07:00
parent 75f1730947
commit 4bd9218bf5
1 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
README.md
View File

@@ -148,7 +148,11 @@ ALGORITHM=HS256
ACCESS_TOKEN_EXPIRE_MINUTES=30
REFRESH_TOKEN_EXPIRE_DAYS=30
# Your host IP or domain (no trailing slash)
# Comma-separated list of allowed origins (no trailing slash)
# IMPORTANT: Add every domain/IP you access the app from.
# If you use a reverse proxy (e.g. Nginx Proxy Manager) with a custom domain,
# you MUST add that domain here or API requests will be blocked by the browser.
# Example: CORS_ORIGINS=http://localhost:8054,https://homeschool.example.com
CORS_ORIGINS=http://localhost:8054
# Super admin credentials (for /super-admin)
@@ -319,7 +323,7 @@ The TV dashboard connects to `ws://host/ws/{child_id}` and receives JSON events:
| `ALGORITHM` | No | JWT algorithm (default: `HS256`) |
| `ACCESS_TOKEN_EXPIRE_MINUTES` | No | Access token lifetime (default: `30`) |
| `REFRESH_TOKEN_EXPIRE_DAYS` | No | Refresh token lifetime (default: `30`) |
| `CORS_ORIGINS` | No | Comma-separated allowed origins (default: `http://localhost:8054`) |
| `CORS_ORIGINS` | No | Comma-separated allowed origins (default: `http://localhost:8054`). **Add every domain you access the app from**, including any custom domain behind a reverse proxy (e.g. `http://localhost:8054,https://homeschool.example.com`). Missing an origin causes API requests to be silently blocked by the browser. |
| `ADMIN_USERNAME` | No | Super admin login username (default: `admin`) |
| `ADMIN_PASSWORD` | No | Super admin login password (default: `change_me_admin_password`) |