# Milestone 1.2 — CORS Middleware Setup Learning Guide

This directory documents the implementation of **Milestone 1, Step 1.2: CORS Middleware Setup**.

---

## Documents in this folder

- **[01-cors-explanation.md](file:///c:/Users/alokc/chatbot/backend/docs/learning/m1-2-cors-setup/01-cors-explanation.md)** — Detailed guide covering:
  - What CORS is and why browsers enforce Same-Origin Policy.
  - Why the embeddable chatbot widget requires CORS support.
  - What constitutes an `Origin` (protocol + domain + port).
  - Why `allow_origins=["*"]` is inappropriate for production multi-tenant systems.
  - How M1.2 configures `CORSMiddleware` cleanly via `.env` and `app/config.py`.
  - An end-to-end request walkthrough example (`https://example.com` $\rightarrow$ `https://api.chatbot.com`).

---

## What you should understand before moving to M1.3

1. **Browser Security:** CORS is enforced by client browsers, not the backend server. The backend simply supplies headers telling the browser whether to allow access.
2. **Environment Configuration:** `ALLOWED_ORIGINS` in `.env` lists origin URLs that are permitted to interact with our API.
3. **Preflight Requests:** For complex HTTP requests, browsers send an `OPTIONS` preflight check before sending the actual payload. `CORSMiddleware` handles this automatically.