From 06663389a046cc36a1aae88b2b20c825153bedd1 Mon Sep 17 00:00:00 2001
From: Maurus Decimus <11444311+mdecimus@users.noreply.github.com>
Date: Fri, 17 Apr 2026 20:26:52 +0200
Subject: [PATCH] HTTP: Fix `204` CORS preflight responses

---
 CHANGELOG.md               |  1 +
 crates/http/src/request.rs | 12 +++++-------
 2 files changed, 6 insertions(+), 7 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7b0318c4..e55e0118 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -95,6 +95,7 @@ This version includes **multiple breaking changes**. If you are upgrading from v
 - ACME: Fix wrong origin for subdomain updates (#2360)
 - Spam filter: Skip invalid messages during training.
 - Calendar: Include minutes in localized invite templates (#2828)
+- HTTP: Fix `204` CORS preflight responses
 
 ## [0.15.5] - 2026-02-14
 
diff --git a/crates/http/src/request.rs b/crates/http/src/request.rs
index a7fb983f..ae7c3443 100644
--- a/crates/http/src/request.rs
+++ b/crates/http/src/request.rs
@@ -211,7 +211,7 @@ impl ParseHttp for Server {
                         };
                     }
                     (_, &Method::OPTIONS) => {
-                        return Ok(JsonProblemResponse(StatusCode::NO_CONTENT).into_http_response());
+                        return Ok(HttpResponse::new(StatusCode::NO_CONTENT));
                     }
                     _ => (),
                 }
@@ -339,7 +339,7 @@ impl ParseHttp for Server {
                         .map(|resource| resource.into_http_response());
                 }
                 (_, &Method::OPTIONS) => {
-                    return Ok(JsonProblemResponse(StatusCode::NO_CONTENT).into_http_response());
+                    return Ok(HttpResponse::new(StatusCode::NO_CONTENT));
                 }
                 _ => (),
             },
@@ -387,14 +387,14 @@ impl ParseHttp for Server {
                     return Ok(self.core.oauth.oidc_jwks.clone().into_http_response());
                 }
                 (_, &Method::OPTIONS) => {
-                    return Ok(JsonProblemResponse(StatusCode::NO_CONTENT).into_http_response());
+                    return Ok(HttpResponse::new(StatusCode::NO_CONTENT));
                 }
                 _ => (),
             },
             "api" => {
                 // Allow CORS preflight requests
                 if req.method() == Method::OPTIONS {
-                    return Ok(JsonProblemResponse(StatusCode::NO_CONTENT).into_http_response());
+                    return Ok(HttpResponse::new(StatusCode::NO_CONTENT));
                 }
 
                 return self.handle_api_request(&mut req, &session).await;
@@ -579,9 +579,7 @@ impl ParseHttp for Server {
                             return self.handle_contact_form(&session, form, form_data).await;
                         }
                         Method::OPTIONS => {
-                            return Ok(
-                                JsonProblemResponse(StatusCode::NO_CONTENT).into_http_response()
-                            );
+                            return Ok(HttpResponse::new(StatusCode::NO_CONTENT));
                         }
                         _ => {}
                     }