finance_app/config/cors.php

<?php

return [
    'paths' => ['api/*', 'v1/*', 'auth/*', 'sanctum/csrf-cookie'],
    
    // 🎯 暫時改成全放行星號，排除 cors.php 這一層的陣列比對干擾
    'allowed_methods' => ['*'],
    'allowed_origins' => ['*'], 
    'allowed_origins_patterns' => [],
    'allowed_headers' => ['*'],
    'exposed_headers' => [],
    'max_age' => 0,
    
    // 🎯 保持 true 以支援登入態 Cookie
    'supports_credentials' => true,
];