From a189ce98a00691cce72b705265c46edd269cf603 Mon Sep 17 00:00:00 2001
From: Giovanni-Josserand <josserand.giovanni@gmail.com>
Date: Thu, 12 Mar 2026 15:52:07 +0100
Subject: [PATCH] call .env variables in cors.php

---
 config/cors.php | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/config/cors.php b/config/cors.php
index fb1bf26..19f2551 100644
--- a/config/cors.php
+++ b/config/cors.php
@@ -15,11 +15,14 @@ return [
     |
     */
 
-    'paths' => ['api/*', 'sanctum/csrf-cookie', 'broadcasting/auth'],
+
+    'paths' => explode(',', env('CORS_PATHS', 'api/*')),
 
     'allowed_methods' => ['*'],
 
-    'allowed_origins' => env('DEV', 0) == 1 ? ['http://localhost:5173'] : ['http://localhost'],
+    'allowed_origins' => env('DEV', 0) == 1
+        ? explode(',', env('DEV_CORS_ALLOWED_ORIGINS'))
+        : explode(',', env('PROD_CORS_ALLOWED_ORIGINS')),
 
     'allowed_origins_patterns' => [],