Fringg 77456efb75 fix: add X-CSRF-Token and X-Telegram-Init-Data to CORS allow_headers ...

The security hardening commit changed allow_headers from ['*'] to
['Authorization', 'Content-Type'], but the frontend sends X-CSRF-Token
on all POST/PUT/DELETE/PATCH requests and X-Telegram-Init-Data on all
requests. The missing headers caused preflight OPTIONS requests to fail
with 400 "Disallowed CORS origin".

2026-03-07 04:30:29 +03:00

..

__init__.py

chore: add uv package manager and ruff linter configuration

2026-01-24 17:45:27 +03:00

payments.py

fix: устранение race conditions и атомарность платёжной системы

2026-03-06 04:20:41 +03:00

remnawave_webhook.py

refactor: complete structlog migration with contextvars, kwargs, and logging hardening

2026-02-16 09:18:12 +03:00

telegram.py

refactor: complete structlog migration with contextvars, kwargs, and logging hardening

2026-02-16 09:18:12 +03:00

unified_app.py

fix: add X-CSRF-Token and X-Telegram-Init-Data to CORS allow_headers

2026-03-07 04:30:29 +03:00