Register the endpoints list without a trailing slash, and stop hiding its errors

shopdb/config.py

@@ -49,6 +49,15 @@ class Config:
         seconds=int(os.environ.get('JWT_REFRESH_TOKEN_EXPIRES', 2592000))
     )
 
+    # Number of reverse proxies in front of this instance. 0 (the default)
+    # means none, and the app reads the connection it actually receives.
+    # Set to 1 when IIS or nginx fronts it, so X-Forwarded-Proto/Host/Prefix are
+    # honoured and a generated absolute URL matches what the browser asked for.
+    # Do NOT set it without a proxy: it makes the app believe forwarded headers
+    # a client can send itself, and the login rate limit and account lockout are
+    # keyed on the client address.
+    TRUSTED_PROXY_COUNT = int(os.environ.get('TRUSTED_PROXY_COUNT', 0))
+
     CORS_ORIGINS = [
         origin.strip()
         for origin in os.environ.get('CORS_ORIGINS', 'http://localhost:5173').split(',')