diff --git a/backend/core/settings.py b/backend/core/settings.py
index b6836f0..c300494 100644
--- a/backend/core/settings.py
+++ b/backend/core/settings.py
@@ -26,9 +26,11 @@ SECRET_KEY = config('SECRET_KEY')
 # SECURITY WARNING: don't run with debug turned on in production!
 DEBUG = config('DEBUG', default=False, cast=bool)
 
-ALLOWED_HOSTS = [host.strip() for host in config('ALLOWED_HOSTS', default='localhost,127.0.0.1').split(',') if host.strip()]
-if 'backend' not in ALLOWED_HOSTS:
-    ALLOWED_HOSTS.append('backend')  # Service Docker utilisé par le proxy Vite.
+def csv_env(name, default=''):
+    """Lit une liste séparée par des virgules en ignorant les valeurs vides."""
+    return [value.strip() for value in config(name, default=default).split(',') if value.strip()]
+
+ALLOWED_HOSTS = csv_env('ALLOWED_HOSTS', 'localhost,127.0.0.1,backend')
 
 # Application definition
 
@@ -127,13 +129,9 @@ USE_TZ = True
 STATIC_URL = 'static/'
 
 # CORS configuration
-CORS_ALLOWED_ORIGINS = [
-    "http://localhost:1028",
-    "http://127.0.0.1:1028",
-    "http://192.168.1.19:1028",
-    'https://www.coursbiologiechaillou.fr',
-    'https://coursbiologiechaillou.fr',
-]
+CORS_ALLOWED_ORIGINS = csv_env('CORS_ALLOWED_ORIGINS')
+CORS_ALLOW_ALL_ORIGINS = config('CORS_ALLOW_ALL_ORIGINS', default=False, cast=bool)
+CSRF_TRUSTED_ORIGINS = csv_env('CSRF_TRUSTED_ORIGINS')
 
 # REST Framework & JWT settings
 REST_FRAMEWORK = {