2026-05-14 15:40:08 +02:00
1 changed files with 4 additions and 3 deletions
@@ -133,9 +133,10 @@ LOG_USER_ID_SALT=replace_with_32_random_bytes_base64url
 # defaulting to localhost is the classic "works in dev, breaks in
 # prod" trap.
 #
-# Local dev: the portal-shell dev server on :4200. Add :4201 once
-# portal-admin grows its own dev server.
-CORS_ALLOWED_ORIGINS=http://localhost:4200
+# Local dev: portal-shell on :4200 and portal-admin on :4300 — both
+# call the BFF with credentials. Source of truth for the ports:
+# `apps/<app>/project.json` `serve.options.port`.
+CORS_ALLOWED_ORIGINS=http://localhost:4200,http://localhost:4300

 # Rate limiting (per ADR-0015 §"DoS mitigation"). Both optional
 # with conservative defaults; override per environment when traffic