From 4df8573b1c38e7b1f3dfd8c23e98623554ffeaeb Mon Sep 17 00:00:00 2001
From: Yisroel Baum <yisroel.d.baum@gmail.com>
Date: Mon, 18 May 2026 22:19:57 +0300
Subject: [PATCH] add frontend cors config

---
 backend/.env.example    |  1 +
 backend/config/cors.php | 23 +++++++++++++++++++++++
 2 files changed, 24 insertions(+)
 create mode 100644 backend/config/cors.php

diff --git a/backend/.env.example b/backend/.env.example
index 409384d..6c57527 100644
--- a/backend/.env.example
+++ b/backend/.env.example
@@ -3,6 +3,7 @@ APP_ENV=local
 APP_KEY=
 APP_DEBUG=true
 APP_URL=http://localhost
+CORS_ALLOWED_ORIGINS=http://localhost:5173,https://rabbigerzi.com,https://www.rabbigerzi.com
 
 APP_LOCALE=en
 APP_FALLBACK_LOCALE=en
diff --git a/backend/config/cors.php b/backend/config/cors.php
new file mode 100644
index 0000000..84d78b2
--- /dev/null
+++ b/backend/config/cors.php
@@ -0,0 +1,23 @@
+<?php
+
+$defaultAllowedOrigins = implode(',', [
+    'http://localhost:5173',
+    'https://rabbigerzi.com',
+    'https://www.rabbigerzi.com',
+]);
+
+$allowedOrigins = array_values(array_filter(array_map(
+    'trim',
+    explode(',', (string) env('CORS_ALLOWED_ORIGINS', $defaultAllowedOrigins))
+)));
+
+return [
+    'paths' => ['login', 'logout', 'me'],
+    'allowed_methods' => ['GET', 'POST', 'OPTIONS'],
+    'allowed_origins' => $allowedOrigins,
+    'allowed_origins_patterns' => [],
+    'allowed_headers' => ['Content-Type', 'X-Requested-With', 'Accept', 'Origin'],
+    'exposed_headers' => [],
+    'max_age' => 0,
+    'supports_credentials' => true,
+];