change port from 5002 to 80

backend/config/settings.py

@@ -39,7 +39,18 @@ def env_json_dict(key: str, default: str = "") -> dict[str, int]:
 SECRET_KEY = env("SECRET_KEY", "insecure-dev-key")
 DEBUG = env_bool("DEBUG", True)
 ALLOWED_HOSTS = env_list("ALLOWED_HOSTS", "localhost,127.0.0.1")
-CSRF_TRUSTED_ORIGINS = env_list("CSRF_TRUSTED_ORIGINS", "http://localhost:8000")
+CSRF_TRUSTED_ORIGINS = env_list(
+    "CSRF_TRUSTED_ORIGINS",
+    "http://localhost:3001,http://127.0.0.1:3001,http://localhost,http://127.0.0.1",
+)
+if DEBUG:
+    # Dev/LAN: allow Vite (:3001) and Docker UI (:80) from private networks.
+    CSRF_TRUSTED_ORIGIN_REGEXES = [
+        r"^http://localhost:\d+$",
+        r"^http://127\.0\.0\.1:\d+$",
+        r"^http://192\.168\.\d{1,3}\.\d{1,3}:\d+$",
+        r"^http://10\.\d{1,3}\.\d{1,3}\.\d{1,3}:\d+$",
+    ]
 
 INSTALLED_APPS = [
     "django.contrib.auth",
@@ -127,7 +138,10 @@ MEDIA_ROOT = BASE_DIR / "media"
 
 DEFAULT_AUTO_FIELD = "django.db.models.BigAutoField"
 
-CORS_ALLOWED_ORIGINS = env_list("CORS_ALLOWED_ORIGINS", "http://localhost:3000")
+CORS_ALLOWED_ORIGINS = env_list(
+    "CORS_ALLOWED_ORIGINS",
+    "http://localhost:3001,http://127.0.0.1:3001,http://localhost,http://127.0.0.1",
+)
 CORS_ALLOW_CREDENTIALS = env_bool("CORS_ALLOW_CREDENTIALS", True)
 
 SESSION_COOKIE_SECURE = env_bool("SESSION_COOKIE_SECURE", False)