Ban CORS requests to the siteadmin and to the auth forms, just in case

2018-05-09 01:29:30 +10:00 · 2018-05-09 01:29:30 +10:00 · b32cefe762
parent 30c4c8ec8f
commit b32cefe762
1 changed files with 1 additions and 0 deletions
--- a/lemoncurry/settings/base.py
+++ b/lemoncurry/settings/base.py
@ -235,6 +235,7 @@ AGENT_COOKIE_SECURE = True

 # django-cors-headers
 CORS_ORIGIN_ALLOW_ALL = True
+CORS_URLS_REGEX = r'^/(?!admin|auth/(?:login|logout|indie)).*$'

 # django-debug-toolbar
 # https://django-debug-toolbar.readthedocs.io/en/stable/configuration.html