From e81fd80944304be4278db9ef4cf2cff98978bb47 Mon Sep 17 00:00:00 2001
From: milesnguyen2405 <miles.nguyen@nexlabglobal.com>
Date: Wed, 22 Jul 2026 11:29:45 +0700
Subject: [PATCH] chore(ui): forward dev proxy origin for dashboard csrf guard

---
 ui/vite.config.ts | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/ui/vite.config.ts b/ui/vite.config.ts
index 4a31e9f5..3ba84058 100644
--- a/ui/vite.config.ts
+++ b/ui/vite.config.ts
@@ -62,10 +62,18 @@ export default defineConfig({
       allow: [UI_ROOT, REPO_ROOT],
     },
     proxy: {
-      '/api': 'http://localhost:3000',
+      // The dashboard's CSRF guard rejects loopback origins on a different
+      // port, so the dev proxy must present the API server's own origin.
+      '/api': {
+        target: 'http://localhost:3000',
+        changeOrigin: true,
+        headers: { origin: 'http://localhost:3000' },
+      },
       '/ws': {
         target: 'ws://localhost:3000',
         ws: true,
+        changeOrigin: true,
+        headers: { origin: 'http://localhost:3000' },
       },
     },
   },