CORS
CORS headers are applied to all /api/* routes by the root middleware (proxy.ts).
CORS is configured at runtime in Settings → CORS (stored in daas_settings) — the middleware prefers those values and caches them for 60 seconds. The CORS_* environment variables are a fallback only, used when the settings row cannot be read (e.g., before migrations have run). On a migrated deployment, change origins in Settings → CORS, not via env vars.
Databases whose settings row predates the CORS-defaults fix (migration 20260319000001_fix_cors_defaults.sql, shipped in v0.1.30) may still contain the legacy wildcard * in cors_origins — that migration deliberately leaves existing rows unchanged. Review Settings → CORS and set explicit origins.
In the env-var fallback, CORS_ORIGINS defaults to empty, which blocks all cross-origin requests. You must explicitly list allowed origins for production.
Common Configurations
Enter origins in Settings → CORS → Allowed Origins (type an origin and press Enter to add it). The env form shown alongside each example applies only as the pre-migration fallback.
Allow a specific domain
Add https://app.example.com to Allowed Origins.
CORS_ORIGINS=https://app.example.comAllow multiple domains
Add https://app.example.com and https://admin.example.com to Allowed Origins.
CORS_ORIGINS=https://app.example.com,https://admin.example.comAllow wildcard subdomains
Add *.example.com to Allowed Origins.
CORS_ORIGINS=*.example.comAllow credentials (e.g., cookie-based auth from a browser)
Add the explicit origin to Allowed Origins and enable Allow Credentials.
CORS_ORIGINS=https://app.example.com
CORS_ALLOW_CREDENTIALS=trueWhen credentials are allowed, the Origin header is echoed back instead of *. The wildcard * is incompatible with credentials: include. Always use explicit origins when credentials are enabled.
Disable CORS entirely (same-origin only)
Turn off Enable CORS in Settings → CORS.
CORS_ENABLED=falseAll Variables
See Environment Variables for the full fallback variable reference.