deer-flow/docker
AochenShen99 c3bc6c7cd5
fix(nginx): defer CORS to gateway allowlist (#2861)
* fix(nginx): defer cors to gateway allowlist

Remove proxy-level wildcard CORS handling so browser origins are controlled by the Gateway allowlist and stay aligned with CSRF origin checks.

* docs: document gateway cors allowlist

Clarify that same-origin nginx access needs no CORS headers while split-origin or port-forwarded browser clients must opt in with GATEWAY_CORS_ORIGINS.

* docs(gateway): record cors source of truth

Document that Gateway CORSMiddleware and CSRFMiddleware share GATEWAY_CORS_ORIGINS as the split-origin source of truth.

* fix(gateway): align cors origin normalization

* docs: clarify gateway langgraph routing

* docs(gateway): update runtime routing note
2026-05-11 17:38:37 +08:00
..
nginx fix(nginx): defer CORS to gateway allowlist (#2861) 2026-05-11 17:38:37 +08:00
provisioner feat(provisioner): add optional PVC support for sandbox volumes (#2020) 2026-04-10 20:40:30 +08:00
dev-entrypoint.sh fix(scripts): preserve uv extras across make dev restarts (#2754) (#2767) 2026-05-10 22:28:29 +08:00
docker-compose-dev.yaml fix(scripts): preserve uv extras across make dev restarts (#2754) (#2767) 2026-05-10 22:28:29 +08:00
docker-compose.yaml fix(harness): resolve runtime paths from project root (#2642) 2026-05-01 22:19:50 +08:00