c3bc6c7cd5
* fix(nginx): defer cors to gateway allowlist Remove proxy-level wildcard CORS handling so browser origins are controlled by the Gateway allowlist and stay aligned with CSRF origin checks. * docs: document gateway cors allowlist Clarify that same-origin nginx access needs no CORS headers while split-origin or port-forwarded browser clients must opt in with GATEWAY_CORS_ORIGINS. * docs(gateway): record cors source of truth Document that Gateway CORSMiddleware and CSRFMiddleware share GATEWAY_CORS_ORIGINS as the split-origin source of truth. * fix(gateway): align cors origin normalization * docs: clarify gateway langgraph routing * docs(gateway): update runtime routing note |
||
|---|---|---|
| .. | ||
| auth | ||
| routers | ||
| __init__.py | ||
| app.py | ||
| auth_middleware.py | ||
| authz.py | ||
| config.py | ||
| csrf_middleware.py | ||
| deps.py | ||
| internal_auth.py | ||
| langgraph_auth.py | ||
| path_utils.py | ||
| services.py | ||
| utils.py | ||