Repository: cookiecutter/cookiecutter-django
Pull request: Update requirements to include django-cors-headers with DRF [PR #2650]
## Description

[//]: # (What's it you're proposing?)

Adding `django_cors_headers` as a part of requirements when a project includes Django REST Framework (DRF). This was brought up in issue #2650.


## Rationale

[//]: # (Why does the project need that?)

Data from DRF usually requires CORS to be consumed. `django-cors-headers` is installed for a DRF project to get past this, so adding it by default to DRF projects will help. 

Fixes #2650

## Use case(s) / visualization(s)

[//]: # ("Better to see something once than to hear about it a thousand times.")

* Create a new Django (or any framework, for that matter) project
* Create a REST endpoint on your backend that returns some placeholder data
* Try to consume this endpoint on a front-end on a different origin - you will receive a Same Origin Policy error
* Use a CORS middleware to bypass this  


Problem statement:
Adding django-cors-headers to requirements if drf selected
## Description

[//]: # (What's it you're proposing? How should it be implemented?)
Adding django-cors-headers to requirements/base.txt if drf is selected in the setup process, having it setup in the settings.



## Rationale

[//]: # (Why should this feature be implemented?)
As far as I know, data from the DRF cannot be consumed without the cors headers properly configured.

Hints from issue discussion:
Would this be adding `django-cors-headers` when `use_drf` is true in `{{cookiecutter.project_slug}}/requirements.base.txt` or would there be more steps involved? I'd like to take this if it's open.
I think that's all we need to do, yes.
Okay, I'll take a look at the guidelines and make a PR. Thanks! 
Created a PR here: #2683

Commit message: Fix style error with quotes

Patch to review:
diff --git a/CONTRIBUTORS.rst b/CONTRIBUTORS.rst
index bba9554af4..875ece2eca 100644
--- a/CONTRIBUTORS.rst
+++ b/CONTRIBUTORS.rst
@@ -44,6 +44,7 @@ Listed in alphabetical order.
   18                       `@dezoito`_
   2O4                      `@2O4`_
   a7p                      `@a7p`_
+  Aadith PM                `@aadithpm`_
   Aaron Eikenberry         `@aeikenberry`_
   Adam Bogdał              `@bogdal`_
   Adam Dobrawy             `@ad-m`_
@@ -235,6 +236,7 @@ Listed in alphabetical order.
   Yuchen Xie               `@mapx`_
 ========================== ============================ ==============
 
+.. _@aadithpm: https://github.com/aadithpm
 .. _@a7p: https://github.com/a7p
 .. _@2O4: https://github.com/2O4
 .. _@ad-m: https://github.com/ad-m
diff --git a/{{cookiecutter.project_slug}}/config/settings/base.py b/{{cookiecutter.project_slug}}/config/settings/base.py
index 7f339fadca..2efd2fcdd6 100644
--- a/{{cookiecutter.project_slug}}/config/settings/base.py
+++ b/{{cookiecutter.project_slug}}/config/settings/base.py
@@ -80,6 +80,7 @@
 {%- if cookiecutter.use_drf == "y" %}
     "rest_framework",
     "rest_framework.authtoken",
+    "corsheaders",
 {%- endif %}
 ]
 
@@ -134,6 +135,9 @@
 # https://docs.djangoproject.com/en/dev/ref/settings/#middleware
 MIDDLEWARE = [
     "django.middleware.security.SecurityMiddleware",
+{%- if cookiecutter.use_drf == 'y' %}
+    "corsheaders.middleware.CorsMiddleware",
+{%- endif %}
 {%- if cookiecutter.use_whitenoise == 'y' %}
     "whitenoise.middleware.WhiteNoiseMiddleware",
 {%- endif %}
@@ -321,6 +325,12 @@
     ),
     "DEFAULT_PERMISSION_CLASSES": ("rest_framework.permissions.IsAuthenticated",),
 }
+
+# django-cors-headers - https://github.com/adamchainz/django-cors-headers#setup
+CORS_URLS_REGEX = {
+    r"^/api.*$",
+}
+
 {%- endif %}
 # Your stuff...
 # ------------------------------------------------------------------------------
diff --git a/{{cookiecutter.project_slug}}/requirements/base.txt b/{{cookiecutter.project_slug}}/requirements/base.txt
index ba62bae083..bf61526600 100644
--- a/{{cookiecutter.project_slug}}/requirements/base.txt
+++ b/{{cookiecutter.project_slug}}/requirements/base.txt
@@ -41,4 +41,6 @@ django-redis==4.12.1  # https://github.com/jazzband/django-redis
 {%- if cookiecutter.use_drf == "y" %}
 # Django REST Framework
 djangorestframework==3.11.0  # https://github.com/encode/django-rest-framework
+# Django CORS Headers
+django-cors-headers==0.01 # https://github.com/adamchainz/django-cors-headers
 {%- endif %}


Code review comments:
diff_hunk: @@ -321,6 +325,12 @@
     ),
     "DEFAULT_PERMISSION_CLASSES": ("rest_framework.permissions.IsAuthenticated",),
 }
+
+# django-cors-headers - https://github.com/adamchainz/django-cors-headers#setup
+CORS_URLS_REGEX = {
+    r"^/api.*$",
+}
path: {{cookiecutter.project_slug}}/config/settings/base.py
text: @user1:
I think this setting should be a string, not a set? Maybe we could also add an extra `/` after the `"api"`:

```suggestion
CORS_URLS_REGEX = r"^/api/.*$"
```

https://github.com/adamchainz/django-cors-headers#cors_urls_regex