From 28317f428f365594df8f9b7f4523a40727644cb3 Mon Sep 17 00:00:00 2001 From: clawbot Date: Mon, 26 Oct 2026 05:43:31 +0000 Subject: [PATCH] README.md: rework against the fourth review CORS: the built page needs no entry. DEBUG: every value is accepted. Model: fable-5-1 --- README.md | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/README.md b/README.md index 286d0af..87c6372 100644 --- a/README.md +++ b/README.md @@ -353,7 +353,7 @@ names the variable. An empty variable counts as unset, except `TRUSTED_PROXIES`. - `SENTRY_DSN`, default empty: the DSN of a Sentry project to report crashes to. See [Sentry](#sentry). - `DEBUG`, default empty: any non-empty value turns debug logging on, `false` - and `0` included. No value of it stops the start. + and `0` included. Every value is accepted. ### Trusted proxies @@ -464,10 +464,11 @@ every report stored before them is deleted to make room. A lower ### CORS The page calls the API from the origin it is served from. By default the server -sends no CORS headers, so browsers let no other origin's pages call it. To serve -the page from elsewhere, list that origin in `CORS_ALLOWED_ORIGINS`, for example -`https://netwatch.example.com`. Pages from a listed origin may `GET` and `POST` -with a `Content-Type` header. +sends no CORS headers, so browsers let no other origin's pages call it. +`CORS_ALLOWED_ORIGINS` lets pages served from the listed origins call the API, +for example `https://netwatch.example.com`. The page as built posts to its own +origin only, so it needs no entry. Pages from a listed origin may `GET` and +`POST` with a `Content-Type` header. Each entry must be a plain origin as browsers send it: `scheme://host`, with an optional `:port`, no path, no trailing `/` and no `*`. Any other entry stops the