Вход из браузера: учитывать X-Forwarded-* — за Caddy свой домен считался чужим для CORS (403)

α Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-11-05 15:43:10 +01:00
1 changed files with 3 additions and 0 deletions
@@ -1,5 +1,8 @@
 spring.application.name=mail-server
 server.port=8080
+# behind a proxy (Jambotron Caddy): take scheme/host from X-Forwarded-*, otherwise the browser's own
+# domain looks like another origin to CORS and every API call with an Origin header gets 403
+server.forward-headers-strategy=framework

 # Secrets: environment variables, or files in a config tree (file name = variable name, e.g. /run/mail-secrets/DB_PASSWORD).
 # No defaults — the server does not start without them (dev profile: application-dev.properties).