CORS and the Next.js proxy

The supported browser path is the Next.js proxy: frontend code requests /api/..., and frontend/src/app/api/[...path]/route.ts forwards the request to NEXT_PUBLIC_BACKEND_URL. This avoids CORS for normal local development.

Direct browser calls to Django are allowed only from the origins configured in CORS_ALLOWED_ORIGINS. The current defaults are:

http://localhost:3000
http://127.0.0.1:3000

CORS_ALLOW_CREDENTIALS is enabled. JWT requests still require Authorization: Bearer <access token>; CORS does not authenticate a request.

When adding a deployment origin, update both CORS and CSRF_TRUSTED_ORIGINS as appropriate. CORS applies to HTTP, not the WebSocket handshake. WebSocket routing and authentication are documented in WEBSOCKET.md.

Preflight check:

curl -i -X OPTIONS http://localhost:8000/api/v1/employees/ \
  -H 'Origin: http://localhost:3000' \
  -H 'Access-Control-Request-Method: GET' \
  -H 'Access-Control-Request-Headers: authorization'

Do not reintroduce Vite port 5173 examples: the current frontend is Next.js on port 3000.

1.1 KiB Raw Permalink Blame History

CORS and the Next.js proxy

1.1 KiB

Raw Permalink Blame History