Repository: cookiecutter/cookiecutter-django

Issue:
API calls from Swagger UI page fail while running the project at "localhost:8000" due to CORS
## What happened?
- New project generated with `use_drf: y`
- When making an API request from the swagger UI at `http://localhost:8000/api/docs/`, the API call fails due to CORS policy
![cors](https://user-images.githubusercontent.com/17159441/154139200-39c4591f-d9ad-4951-832e-1bf70e0c0194.jpg)


## What should've happened instead?
The API call should have worked with no issues

## Additional details
The issue is due to project running on localhost:8000 while the `SERVERS` option in drf-spectacular settings has the url `http://127.0.0.1:8000`.

It seems like there is more than one option to fix this:
- one way is to set the `CORS_ALLOWED_ORIGINS = ["http://localhost:8000", "http://127.0.0.1:8000"]` in local settings so that api calls from `localhost:8000` work fine ([django-cors-headers docs](https://github.com/adamchainz/django-cors-headers#cors_allowed_origins-sequencestr))
- the other option is to remove `SERVERS` from drf-spectacular

I'm leaning towards the second option and that's because I don't think it's a good idea to be able to make API call to a production server when working locally. Also, When the project is deployed to production, it doesn't make a lot of sense to see the option for making API calls to "127.0.01:8000" in the swagger UI page.

So, before creating a PR, I wanted to check if there are good reasons to keep `SERVERS` in drf-spectacular settings (or maybe there is a better third option)


Discussion:
Hum, that's a good point. What is the implication of the second option, if we remove `SERVERS`? Is it just using the current host? 

This config was suggested [in the code review](https://github.com/cookiecutter/cookiecutter-django/pull/3536#discussion_r785925745), and at the time it seemed like a good idea. However, given this extra problem with CORS policy, it now seems not so great. We could set it to the right values in `local.py` and `production.py`, but maybe the 2nd option you suggest is much simpler...

(Just my ideas at a glance, I haven't looked into it in details yet)
Tools like https://stoplight.io can use the SERVERS to generate [code samples](https://meta.stoplight.io/docs/platform/ZG9jOjM2OTM3Mjky-try-it) of requests pointing to the "correct" domain.

> What is the implication of the second option, if we remove SERVERS? Is it just using the current host?

yes, it will use the current host. 

Sample request when running on `127.0.0.1:8000`:
<img src="https://user-images.githubusercontent.com/17159441/154219969-c1fa2266-2d40-4ed5-bee1-f162e81986bc.png" width="300" alt="docs_page_without_servers_127_0_0_1">
Sample request when running on `localhost:8000`:
<img src="https://user-images.githubusercontent.com/17159441/154219974-934a41d2-2e86-4c91-8d44-ebceb4d9748e.png" width="300" alt="docs_page_without_servers_localhost">



Resolving patch:
diff --git a/{{cookiecutter.project_slug}}/config/settings/base.py b/{{cookiecutter.project_slug}}/config/settings/base.py
--- a/{{cookiecutter.project_slug}}/config/settings/base.py
+++ b/{{cookiecutter.project_slug}}/config/settings/base.py
@@ -346,10 +346,6 @@
     "DESCRIPTION": "Documentation of API endpoints of {{ cookiecutter.project_name }}",
     "VERSION": "1.0.0",
     "SERVE_PERMISSIONS": ["rest_framework.permissions.IsAdminUser"],
-    "SERVERS": [
-        {"url": "http://127.0.0.1:8000", "description": "Local Development server"},
-        {"url": "https://{{ cookiecutter.domain_name }}", "description": "Production server"},
-    ],
 }
 {%- endif %}
 # Your stuff...
diff --git a/{{cookiecutter.project_slug}}/config/settings/production.py b/{{cookiecutter.project_slug}}/config/settings/production.py
--- a/{{cookiecutter.project_slug}}/config/settings/production.py
+++ b/{{cookiecutter.project_slug}}/config/settings/production.py
@@ -358,5 +358,15 @@
     traces_sample_rate=env.float("SENTRY_TRACES_SAMPLE_RATE", default=0.0),
 )
 {% endif %}
+{% if cookiecutter.use_drf == "y" -%}
+
+# django-rest-framework
+# -------------------------------------------------------------------------------
+# Tools that generate code samples can use SERVERS to point to the correct domain
+SPECTACULAR_SETTINGS["SERVERS"] = [  # noqa F405
+    {"url": "https://{{ cookiecutter.domain_name }}", "description": "Production server"}
+]
+
+{%- endif %}
 # Your stuff...
 # ------------------------------------------------------------------------------


Test patch: