feat(cors): configure CORS settings for development and production environments

djinit/templates/project/settings/base.j2

@@ -149,13 +149,28 @@ SIMPLE_JWT = {
 }
 
 # CORS Settings
-CORS_ALLOWED_ORIGINS = [
-    "http://localhost:3000",
-    "http://127.0.0.1:3000",
+CORS_ALLOW_METHODS = [
+    "DELETE",
+    "GET",
+    "OPTIONS",
+    "PATCH",
+    "POST",
+    "PUT",
 ]
 
-CORS_ALLOW_CREDENTIALS = True
+CORS_ALLOW_HEADERS = [
+    "accept",
+    "accept-encoding",
+    "authorization",
+    "content-type",
+    "dnt",
+    "origin",
+    "user-agent",
+    "x-csrftoken",
+    "x-requested-with",
+]
 
+CORS_PREFLIGHT_MAX_AGE = 86400  # 24 hours
 # Security Settings
 SECURE_BROWSER_XSS_FILTER = True
 SECURE_CONTENT_TYPE_NOSNIFF = True

djinit/templates/project/settings/development.j2

@@ -23,7 +23,9 @@ DATABASES = {
 EMAIL_BACKEND = "django.core.mail.backends.console.EmailBackend"
 
 # CORS settings for development
+# Allow all origins in development (convenient but not secure)
 CORS_ALLOW_ALL_ORIGINS = True
+CORS_ALLOW_CREDENTIALS = True
 
 # Disable HTTPS redirect in development
 SECURE_SSL_REDIRECT = False

djinit/templates/project/settings/production.j2

@@ -28,7 +28,16 @@ DATABASES = {
 }
 {% endif %}
 
+# CORS settings for production
+# Filter out empty strings from FRONTEND_URL
+frontend_urls = os.getenv("FRONTEND_URL", "")
+CORS_ALLOWED_ORIGINS = [
+    origin.strip() for origin in frontend_urls.split(",") if origin.strip()
+]
+CORS_ALLOW_CREDENTIALS = True
 
+# Additional CORS security for production
+CORS_ALLOW_PRIVATE_NETWORK = False
 
 # Email settings
 EMAIL_BACKEND = 'django.core.mail.backends.smtp.EmailBackend'

djinit/templates/shared/env_sample.j2

@@ -15,6 +15,9 @@ DB_HOST=
 DB_PORT=
 {% endif %}
 
+# Frontend URL
+FRONTEND_URL=http://frontend.your-domain.com
+
 # Email settings
 EMAIL_HOST=
 EMAIL_PORT=