server: allow CORS credentials

server/reflector/app.py

@@ -46,6 +46,7 @@ else:
 app = FastAPI(lifespan=lifespan)
 app.add_middleware(
     CORSMiddleware,
+    allow_credentials=settings.CORS_ALLOW_CREDENTIALS or False,
     allow_origins=settings.CORS_ORIGIN.split(","),
     allow_methods=["*"],
     allow_headers=["*"],

server/reflector/settings.py

@@ -8,6 +8,7 @@ class Settings(BaseSettings):
 
     # CORS
     CORS_ORIGIN: str = "*"
+    CORS_ALLOW_CREDENTIALS: bool = False
 
     # Database
     DATABASE_URL: str = "sqlite:///./reflector.sqlite3"