Browser sends Origin header on fetch calls even same-origin. Server needs the public host in its CORS allowlist. Derived from PUBLIC_HOST. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
8.8 KiB
8.8 KiB