# CORS and the Next.js proxy

The supported browser path is the Next.js proxy: frontend code requests
`/api/...`, and `frontend/src/app/api/[...path]/route.ts` forwards the request to
`NEXT_PUBLIC_BACKEND_URL`. This avoids CORS for normal local development.

Direct browser calls to Django are allowed only from the origins configured in
`CORS_ALLOWED_ORIGINS`. The current defaults are:

```text
http://localhost:3000
http://127.0.0.1:3000
```

`CORS_ALLOW_CREDENTIALS` is enabled. JWT requests still require
`Authorization: Bearer <access token>`; CORS does not authenticate a request.

When adding a deployment origin, update both CORS and `CSRF_TRUSTED_ORIGINS` as
appropriate. CORS applies to HTTP, not the WebSocket handshake. WebSocket routing
and authentication are documented in [`WEBSOCKET.md`](WEBSOCKET.md).

Preflight check:

```bash
curl -i -X OPTIONS http://localhost:8000/api/v1/employees/ \
  -H 'Origin: http://localhost:3000' \
  -H 'Access-Control-Request-Method: GET' \
  -H 'Access-Control-Request-Headers: authorization'
```

Do not reintroduce Vite port 5173 examples: the current frontend is Next.js on
port 3000.