feat(web)!: remove web.Config.AllowedOrigins; CORS lives only on server.Config.CORSOrigins (v1.3.0)

2026-08-08 10:48:00 -06:00
parent c611e67946
commit 929fafcfa5
6 changed files with 46 additions and 24 deletions
@@ -19,7 +19,7 @@ const (
 //	if strings.EqualFold(cfg.AppEnv, "local") {
 //	    corsMW = mw.CORSAllowAll()            // dev: any origin
 //	} else {
-//	    corsMW = mw.CORS(cfg.AllowedOrigins)  // prod: explicit origins
+//	    corsMW = mw.CORS(cfg.CORSOrigins)     // prod: explicit origins
 //	}
 func CORS(origins []string) func(http.Handler) http.Handler {
 	// "*" would be a silent no-op (exact-match only) — reject it loudly so a