fix: allow explicit HTTP origin in test environments

2026-08-27 18:32:21 +08:00
parent 01cffa4758
commit 070a951e7c
3 changed files with 28 additions and 3 deletions
@@ -10,6 +10,8 @@ REDIS_URL=redis://127.0.0.1:6379
 HTTP_API_MASTER_KEY=replace-with-at-least-32-random-characters
 # Customer-facing HTTP API origin returned by the real backend and shown in copied integration parameters.
 HTTP_API_PUBLIC_ORIGIN=https://api.example.com
+# Keep false in production. Only isolated test environments without TLS may opt in to HTTP.
+HTTP_API_ALLOW_INSECURE_ORIGIN=false
 API_ENABLE_SEND_WORKER=true
 API_SEND_WORKER_CONCURRENCY=50
 API_WORKER_DATABASE_URL=