rate-limit,cors

2026-10-05 19:12:24 +05:30
parent eead8f5ffd
commit 1a596217b7
5 changed files with 175 additions and 3 deletions
@@ -1,5 +1,12 @@
 PORT=5000
 NODE_ENV=production
+# ─── CORS ─────────────────────────────────────────────────
+# Comma-separated list of EXACT origins (scheme+host+port) allowed to make
+# credentialed (cookie-carrying) requests to this API. Leave blank to reflect
+# any origin back (fine on a private LAN — this is today's default). Once
+# this app has a real public domain, set it, e.g.:
+# CORS_ALLOWED_ORIGINS=https://portal.mitraindustries.com
+CORS_ALLOWED_ORIGINS=https://erp.miplapp.in
 # NOTE: The following app settings moved OUT of .env and are now edited from
 # the Admin panel (System Settings tab), persisted in the app DB table
 # ZAPP_SETTINGS (see services/appSettingsStore.js): BOM approval levels, skip