fix(cors): use explicit origins instead of wildcard

When allow_credentials=True, browsers reject wildcard (*) origins.
Added specific allowed origins for Tatlock domains.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -5,6 +5,14 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.9.1] - 2026-01-03
+
+### Fixed
+
+- CORS configuration now uses explicit origins instead of `"*"`
+  - When `allow_credentials=True`, wildcard origins are rejected by browsers
+  - Added `home.schweitz.net`, `tatlock.schweitz.net`, and localhost origins
+
 ## [1.9.0] - 2026-01-03
 
 ### Added

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "core-api"
-version = "1.9.0"
+version = "1.9.1"
 description = "Core Code API - Infrastructure management and tools API"
 readme = "README.md"
 requires-python = ">=3.12"

src/shared/config.py

@@ -36,8 +36,15 @@ class Settings(BaseSettings):
     host: str = "0.0.0.0"
     port: int = 8083
 
-    # CORS
+    # CORS - Note: When cors_credentials is True, cannot use "*" for origins
-    cors_origins: list[str] = ["*"]
+    # Set CORS_ORIGINS env var to override (comma-separated list)
+    cors_origins: list[str] = [
+        "https://home.schweitz.net",
+        "https://tatlock.schweitz.net",
+        "http://localhost:8080",
+        "http://localhost:3000",
+        "http://127.0.0.1:8080",
+    ]
     cors_credentials: bool = True
     cors_methods: list[str] = ["*"]
     cors_headers: list[str] = ["*"]