feat: add CORS configuration options to enhance API security

2025-12-19 02:33:00 +09:00
parent ea5a0004da
commit 1806e0823f
3 changed files with 75 additions and 8 deletions
@@ -14,4 +14,18 @@ PLEXPLAYLISTSYNC_AUTH_PASSWORD=CHANGE_PASSWORD
 PLEXPLAYLISTSYNC_AUTH_TOKEN_SECRET=REPLACE_WITH_A_RANDOM_STRING

 # Token TTL seconds (optional)
-PLEXPLAYLISTSYNC_AUTH_TOKEN_TTL_SECONDS=86400
+PLEXPLAYLISTSYNC_AUTH_TOKEN_TTL_SECONDS=86400
+
+# CORS allowlist (optional)
+# Default is empty (CORS disabled; same-origin only).
+# Accepts comma-separated list or a JSON array.
+# Example:
+# PLEXPLAYLISTSYNC_CORS_ALLOWED_ORIGINS=http://localhost:5173,http://127.0.0.1:5173
+# or
+# PLEXPLAYLISTSYNC_CORS_ALLOWED_ORIGINS=["https://your.domain"]
+PLEXPLAYLISTSYNC_CORS_ALLOWED_ORIGINS=
+
+# Allow cookies/credentials for allowlisted origins (optional)
+# 1 = enabled, 0 = disabled
+# Note: if origins contains '*', credentials will be forced off.
+PLEXPLAYLISTSYNC_CORS_ALLOW_CREDENTIALS=0