"POST /api/auth/login HTTP/1.1" 403 ... "http://10.0.20.15:19080/login"

graph TD
	A[브라우저 fetch POST, Origin: http://10.0.20.15:19080]
	B[nginx 프록시 - Origin 헤더 그대로 전달]
	C[Spring Security CorsFilter]
	D{Origin이 허용 목록에 있는가}
	E[컨트롤러 진입]
	F[403 즉시 반환 - 로그 없음]

	A --> B --> C --> D
	D -->|Yes| E
	D -->|No| F

// 허용 Origin이 코드에 하드코딩되어 있었다
configuration.setAllowedOrigins(List.of(
    "http://localhost:3000",
    "http://localhost:5173"
));

@Value("${cors.allowed-origins:http://localhost:3000,http://localhost:5173}")
private String corsAllowedOrigins;

@Bean
public CorsConfigurationSource corsConfigurationSource() {
    CorsConfiguration configuration = new CorsConfiguration();
    List<String> origins = Arrays.stream(corsAllowedOrigins.split(","))
            .map(String::trim)
            .toList();
    configuration.setAllowedOrigins(origins);
    configuration.setAllowedMethods(List.of("GET", "POST", "PUT", "DELETE", "OPTIONS"));
    configuration.setAllowedHeaders(List.of("*"));
    configuration.setAllowCredentials(true);
    UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
    source.registerCorsConfiguration("/**", configuration);
    return source;
}

environment:
  CORS_ALLOWED_ORIGINS: ${CORS_ALLOWED_ORIGINS:-http://localhost:3000,http://localhost:5173}

CORS_ALLOWED_ORIGINS=http://10.0.20.15:19080