SluijsensandClaude Haiku 4.5
5331be4279
Chrome 89+ schemeful same-site treats http://localhost and https://localhost as different sites, blocking SameSite=Strict cookies on cross-origin fetch (e.g. Vite on port 5173, API on port 7221). Fix: make CookieSameSite configurable per environment in JwtSettings. - Default: Strict (production) - appsettings.Development.json: None (allows cross-origin cookie in dev) - When SameSite=None, Secure is always forced (browser requirement) Revert the earlier Vite proxy approach in favour of this backend config. VITE_API_BASE_URL remains a freely configurable URL in .env.local. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
7 lines
376 B
Bash
7 lines
376 B
Bash
# Base URL of the SlpModularCms .NET API.
|
|
# The backend must be running with CORS configured to allow this origin
|
|
# and to send the httpOnly refresh-token cookie (credentials: include).
|
|
# Set CookieSameSite=None in appsettings.Development.json so the cookie
|
|
# is sent cross-origin when the frontend and backend run on different ports.
|
|
VITE_API_BASE_URL=https://localhost:7221
|