Describe the bug
The env var parser automatically splits Sequence type args on path.sep (colon on posix), so trying to specify a URL as a CORS origin ends up splitting the string into parts
To Reproduce
REFLEX_CORS_ALLOWED_ORIGINS=http://localhost:3000 python -c 'import reflex as rx; print(rx.Config(app_name="_").cors_allowed_origins)'
['http', '//localhost', '3000']
Expected behavior
Need another way of splitting CORS origins, so that a common and necessary character in URLs is not treated as a delimiter.
`['http://localhost:3000']
Specifics (please complete the following information):
- Python Version: 3.14
- Reflex Version: 0.8.24
- OS: macOS
Workaround
- set
allowed_cors_origins in rxconfig.py