Fix CORS configuration to prevent startup error

- Changed CORS_ORIGINS default from "*" to NEXT_FRONTEND_URL fallback
- Wildcard "*" is incompatible with allow_credentials=True in FastAPI
- Updated .env.example with warning about wildcard usage
- Defaults now properly cascade: CORS_ORIGINS -> NEXT_FRONTEND_URL -> localhost:3000

surfsense_backend/.env.example

@@ -32,8 +32,10 @@ AUTH_TYPE=LOCAL
 REGISTRATION_ENABLED=TRUE or FALSE
 
 # CORS Configuration (comma-separated list of allowed origins)
-# Use * to allow all origins, or specify domains like: https://example.com,https://app.example.com
-CORS_ORIGINS=*
+# WARNING: Do not use "*" - it's incompatible with credentials and insecure for production
+# Defaults to NEXT_FRONTEND_URL if not set
+# Example: CORS_ORIGINS=https://example.com,https://app.example.com
+# CORS_ORIGINS=http://localhost:3000
 
 # Google OAuth Credentials (OPTIONAL - Required only for Gmail and Google Calendar connectors)
 GOOGLE_OAUTH_CLIENT_ID=your_google_client_id

surfsense_backend/app/config/__init__.py

@@ -136,8 +136,9 @@ class Config:
     REGISTRATION_ENABLED = os.getenv("REGISTRATION_ENABLED", "TRUE").upper() == "TRUE"
 
     # CORS Configuration
-    # Comma-separated list of allowed origins, defaults to all origins if not set
-    _cors_origins_str = os.getenv("CORS_ORIGINS", "*")
+    # Comma-separated list of allowed origins, defaults to frontend URL
+    # Note: Wildcard "*" is not allowed when allow_credentials=True
+    _cors_origins_str = os.getenv("CORS_ORIGINS", os.getenv("NEXT_FRONTEND_URL", "http://localhost:3000"))
     CORS_ORIGINS = [origin.strip() for origin in _cors_origins_str.split(",") if origin.strip()]
 
     # Google OAuth