Update src/main.py

src/main.py

@@ -1,5 +1,11 @@
 from fastapi import FastAPI
 from fastapi.middleware.cors import CORSMiddleware
+from .config import settings
+
+# If FRONTEND_URL is https but JWT_COOKIE_SECURE is not set to True, warn the deployer
+if settings.FRONTEND_URL.startswith("https://") and not settings.JWT_COOKIE_SECURE:
+    import warnings
+    warnings.warn("FRONTEND_URL uses https but JWT_COOKIE_SECURE is False. Set JWT_COOKIE_SECURE=True in production so browsers accept SameSite=None cookies (requires Secure).")
 
 from .routers import auth, tasks, projects
 
@@ -17,7 +23,7 @@ app.include_router(projects.router)
 # CORS configuration (development and production)
 app.add_middleware(
     CORSMiddleware,
-    allow_origins=["*"],  # Allow all origins for development
+    allow_origins=["https://task-flow-mauve-zeta.vercel.app", "http://localhost:3000"],  # Use configured frontend origin (set to your Vercel URL in production)
     allow_credentials=True,
     allow_methods=["*"],
     allow_headers=["*"],