nelmio_cors:
    defaults:
        allow_origin: ['*']  # En production, remplacez '*' par les domaines spécifiques autorisés
        allow_methods: ["GET", "POST", "PUT", "DELETE", "OPTIONS"]
        allow_headers: ["Content-Type", "Authorization"]
        expose_headers: ["Authorization"]
        max_age: 3600
        allow_credentials: true
    paths:
        '^/':  # Applique la règle à toutes les routes (y compris /api)
            allow_origin: ['*']
            allow_methods: ["GET", "POST", "PUT", "DELETE", "OPTIONS"]
            allow_headers: ["Content-Type", "Authorization"]
            expose_headers: ["Authorization"]
            allow_credentials: true