Fix auth session persistence with HttpOnly cookies and CSRF

2026-03-01 21:39:22 -03:00
parent a9333ec973
commit 26eae1a09b
14 changed files with 255 additions and 108 deletions
--- a/backend/app/main.py
+++ b/backend/app/main.py
@@ -39,7 +39,7 @@ def create_app() -> FastAPI:
    app.add_middleware(
        CORSMiddleware,
        allow_origins=allowed_origins,
-        allow_credentials=False,
+        allow_credentials=True,
        allow_methods=["*"],
        allow_headers=["*"],
    )