A trailing slash on CORS_ORIGINS never matches a browser's Origin header (which never includes a path), silently breaking CORS with no error message beyond the browser's generic "No Access-Control-Allow-Origin header" — exactly what happened in production after switching domains. A trailing slash on PUBLIC_URL/FRONTEND_BASE_URL similarly produced double-slash URLs in API responses and reset-password links. All three are now normalized at config-load time so a .env typo can't cause this again. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Description
No description provided
Languages
Python
100%