Changes between Version 24 and Version 25 of P9

Timestamp:

06/23/26 00:12:53 (3 days ago)

Author:

211099

Comment:

--

P9

@@ -886 +886 @@
     => await _dbSet.Where(c => c.StoryId == storyId).ToListAsync(cancellationToken);
 }}}
+== CORS Configuration
+ChapterX defines a CORS policy that restricts which origins are allowed to make requests to the API. Without this, any website could send requests on behalf of a logged-in user from their browser.
+The policy is registered in Program.cs and applied globally before any other middleware:
+{{{
+builder.Services.AddCors(options =>
+{
+    options.AddPolicy("Frontend", policy =>
+        policy.WithOrigins("http://localhost:5173", "https://localhost:5173")
+              .AllowAnyHeader()
+              .AllowAnyMethod());
+});
+app.UseCors("Frontend");
+}}}
+Only the frontend development server (localhost:5173) is whitelisted as an allowed origin. Requests originating from any other domain are rejected at the browser level before they reach any controller logic.
+In a production environment, localhost:5173 should be replaced with the actual deployed frontend domain.