diff --git a/config/cors.php b/config/cors.php
index 086cea0..194df09 100644
--- a/config/cors.php
+++ b/config/cors.php
@@ -1,12 +1,39 @@
 <?php
 
 return [
+
+    /*
+    |--------------------------------------------------------------------------
+    | Cross-Origin Resource Sharing (CORS) Configuration
+    |--------------------------------------------------------------------------
+    |
+    | Here you may configure your settings for cross-origin resource sharing
+    | or "CORS". This determines what cross-origin operations may execute
+    | in web browsers. You are free to adjust these settings as needed.
+    |
+    */
+
+    // 🎯 1. 確保包含了你前端呼叫的所有路徑前綴
     'paths' => ['api/*', 'v1/*', 'auth/*', 'sanctum/csrf-cookie'],
+
     'allowed_methods' => ['*'],
-    'allowed_origins' => ['https://fin-buddy.duckdns.org', 'http://localhost:5173', 'http://127.0.0.1:5173'],
+
+    // 🎯 2. 精準放行本地端 Vite（5173）與雲端生產網域
+    'allowed_origins' => [
+        'https://fin-buddy.duckdns.org',
+        'http://localhost:5173',
+        'http://127.0.0.1:5173'
+    ],
+
     'allowed_origins_patterns' => [],
+
     'allowed_headers' => ['*'],
+
     'exposed_headers' => [],
+
     'max_age' => 0,
+
+    // 🎯 3. 超級關鍵！因為你在本地測試有帶登入態（Cookie/Session），這項一定要是 true！
     'supports_credentials' => true,
+
 ];