fix(cors): allow PATCH and the client headers under the restricted policy - #1391
Merged
Merged
Conversation
…olicy The restricted policy only allowed content-type and authorization, so with CorsOptions:AllowAll=false the browser rejects the preflight for: - tenant (every API call from both apps) - X-FSH-App (login) - Idempotency-Key (chat sends) - X-Requested-With / X-SignalR-User-Agent (SignalR negotiate) Fixes #1367. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This was referenced Sep 25, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
With
CorsOptions:AllowAll=false(the shippedappsettings.jsonandappsettings.Production.json), the browser rejects preflights from both React apps. Dev hides this becauseappsettings.Development.jsonsetsAllowAll=true.Changes
AllowedMethods— cherry-picked from fix(cors): allow PATCH in restricted policy #1371 by @CattonNyan (authorship kept). Fixes CORS: PATCH is missing from AllowedMethods, blocking existing PATCH APIs under the restricted policy #1370.AllowedHeaders— fixes CORS: the mandatory 'tenant' header is missing from CorsOptions.AllowedHeaders, breaking both front-ends under the restricted policy #1367. The restricted list was onlycontent-type,authorization:tenantapi-client.ts)x-fsh-appauth/api.ts)idempotency-keyx-requested-with,x-signalr-user-agent@microsoft/signalrnegotiateConfig-file regression tests cover both shipped files; they fail without the header change (10 red) and pass with it.
Upgrade note: deployers who override
CorsOptions:AllowedHeadersmust add these headers, or login and realtime fail under restricted CORS.Supersedes #1371 (its CI ran on a base from before the dependency advisory fixes, so it can't go green as-is).
🤖 Generated with Claude Code