yasuki_web.config.allowed_origins

allowed_origins()

The browser origins permitted to call the API and open WebSockets.

Read from the comma-separated CORS_ORIGINS env var, falling back to the local dev front-end ports. Raise ValueError on a * entry: both the CORS layer and the WebSocket origin check rely on a concrete allowlist, so a wildcard is rejected outright.