fix: developer setup for non ngrok users

[wizzah]

Adds CORS_ORIGIN_WHITELIST to settings when debug is on, which fixes a CSRF verification error

Are you finished?

Linters

• I have checked my code with black, pylint, and mypy, or ./bw-dev formatters

Tests

• My changes do not need new tests
• All tests I have added are passing
• I have written tests but need help to make them pass
• I have not written tests and need help to write them

What type of Pull Request is this?

• Bug Fix
• Enhancement
• Plumbing / Internals / Dependencies
• Refactor

Does this PR change settings or dependencies, or break something?

• This PR changes or adds default settings, configuration, or .env values
• This PR changes or adds dependencies
• This PR introduces other breaking changes

Details of breaking or configuration changes (if any of above checked)

Description

• Related Issue #
• Closes #

Documentation

• New or amended documentation will be required if this PR is merged
• I have created a matching pull request in the Documentation repository
• I intend to create a matching pull request in the Documentation repository after this PR is merged

[dato]

Hello!

I searched the Django docs for this setting, but could only find it in the docs for the django-cors-headers package. Is this setting useful without installing that?

If you can, I'd like to understand how to reproduce the CSRF failure that this fixes. I can run a non-ngrok setup myself with:

DOMAIN="localhost:1335"
DEBUG="true"
USE_HTTPS="no"

and login works, and could not see any breakage.

Thanks!!

[wizzah]

Thanks for taking a look! I'll try to recreate the issue again

[mouse-reeve]

I had the same experience as @dato when trying to log in using localhost, so I'm going to close this PR. Thank you both for working on this!