59 lines
2.8 KiB
Plaintext
59 lines
2.8 KiB
Plaintext
# ============================================================================
|
|
# Krow frontend — example environment
|
|
#
|
|
# Copy to .env and adjust. .env is gitignored.
|
|
#
|
|
# cp .env.example .env
|
|
#
|
|
# Vite only exposes variables prefixed with VITE_ to client code, and it reads
|
|
# these at build/dev-server start — changing one needs a restart, not a reload.
|
|
# ============================================================================
|
|
|
|
# Where the browser sends API requests.
|
|
#
|
|
# A SAME-ORIGIN PATH, not a host. The browser asks its own origin for
|
|
# /api/v1/..., and something on that origin forwards it to the Go API:
|
|
# in development the Vite proxy (see `server.proxy` in vite.config.js), in
|
|
# production the same web server that serves the built assets (see nginx.conf).
|
|
#
|
|
# browser → localhost:5173/api/v1 → Vite proxy → 127.0.0.1:8080/api/v1
|
|
#
|
|
# THIS MUST STAY A PATH. Pointing it at http://127.0.0.1:8080/api/v1 makes every
|
|
# request cross-site, and the session cookie stops working in two separate ways:
|
|
#
|
|
# 1. The cookie is SameSite=Lax, and a Lax cookie is not sent on a cross-site
|
|
# subresource request. A browser treats localhost:5173 and 127.0.0.1:8080
|
|
# as different sites, so the cookie would be set at login and then never
|
|
# sent again.
|
|
# 2. Because the transport sends `credentials: 'include'`, the browser
|
|
# requires `Access-Control-Allow-Credentials: true` on the preflight
|
|
# response. The API does not send it — deliberately, because the supported
|
|
# arrangement is same-origin — so Chrome discards the preflight and never
|
|
# dispatches the real request. The symptom is an OPTIONS that answers 204
|
|
# followed by a POST that never reaches the server at all.
|
|
#
|
|
# Both failures are silent from the page's point of view, which is why this
|
|
# comment is longer than the value.
|
|
VITE_API_BASE_URL=/api/v1
|
|
|
|
# PRODUCTION BUILDS ARE DIFFERENT. The relative value above is correct only
|
|
# where something on the page's own origin forwards /api — the Vite proxy in
|
|
# development. The deployed frontend at platform.krowforce.com is a static nginx
|
|
# host with no such forward (see nginx.conf: no `location /api/`), so a relative
|
|
# path makes the login POST land on a static route and answer 405 Method Not
|
|
# Allowed.
|
|
#
|
|
# The production value is therefore absolute, and it is set as a build-time
|
|
# environment variable rather than here, because .dockerignore excludes .env*
|
|
# and no env file reaches the image build:
|
|
#
|
|
# ARG VITE_API_BASE_URL=https://mcp.krowforce.com/api/v1 (see Dockerfile)
|
|
#
|
|
# platform.krowforce.com and mcp.krowforce.com are different origins but the
|
|
# same site, so the SameSite=Lax session cookie is still sent — which is why
|
|
# production works cross-origin while localhost cannot.
|
|
|
|
# Where the Vite dev proxy forwards /api. Only read by vite.config.js, never by
|
|
# client code.
|
|
VITE_API_PROXY_TARGET=https://mcp.krowforce.com
|