Вход из браузера: учитывать X-Forwarded-* — за Caddy свой домен считался чужим для CORS (403)

α
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

backend/src/main/resources/application.properties

@@ -1,5 +1,8 @@
 spring.application.name=mail-server
 server.port=8080
+# behind a proxy (Jambotron Caddy): take scheme/host from X-Forwarded-*, otherwise the browser's own
+# domain looks like another origin to CORS and every API call with an Origin header gets 403
+server.forward-headers-strategy=framework
 
 # Secrets: environment variables, or files in a config tree (file name = variable name, e.g. /run/mail-secrets/DB_PASSWORD).
 # No defaults — the server does not start without them (dev profile: application-dev.properties).