Fix HTTP: Use permissive CORS headers for .well-known endpoints

crates/http-proto/src/response.rs

@@ -179,6 +179,21 @@ impl HttpResponse {
         self
     }
 
+    pub fn with_cors_unrestricted(mut self) -> Self {
+        self.builder = self
+            .builder
+            .header(header::ACCESS_CONTROL_ALLOW_ORIGIN, "*")
+            .header(
+                header::ACCESS_CONTROL_ALLOW_HEADERS,
+                "Authorization, Content-Type, Accept, X-Requested-With",
+            )
+            .header(
+                header::ACCESS_CONTROL_ALLOW_METHODS,
+                "POST, GET, PATCH, PUT, DELETE, HEAD, OPTIONS",
+            );
+        self
+    }
+
     pub fn size(&self) -> usize {
         match &self.body {
             HttpResponseBody::Text(value) => value.len(),

crates/http/src/auth/oauth/auth.rs

@@ -456,6 +456,7 @@ impl OAuthApiHandler for Server {
             code_challenge_methods_supported: &["S256"],
             issuer: base_url.to_string(),
         })
-        .into_http_response())
+        .into_http_response()
+        .with_cors_unrestricted())
     }
 }

crates/http/src/auth/oauth/openid.rs

@@ -99,6 +99,7 @@ impl OpenIdHandler for Server {
             code_challenge_methods_supported: &["S256"],
             issuer: base_url.to_string(),
         })
-        .into_http_response())
+        .into_http_response()
+        .with_cors_unrestricted())
     }
 }

crates/http/src/request.rs

@@ -321,7 +321,8 @@ impl ParseHttp for Server {
                         .await?
                         .into_bytes(),
                     )
-                    .into_http_response());
+                    .into_http_response()
+                    .with_cors_unrestricted());
                 }
                 ("mail-v1.xml", &Method::GET) => {
                     // Limit anonymous requests
@@ -344,10 +345,10 @@ impl ParseHttp for Server {
                     return self
                         .handle_autoconfig_request(req.uri().query())
                         .await
-                        .map(|resource| resource.into_http_response());
+                        .map(|resource| resource.into_http_response().with_cors_unrestricted());
                 }
                 (_, &Method::OPTIONS) => {
-                    return Ok(HttpResponse::new(StatusCode::NO_CONTENT));
+                    return Ok(HttpResponse::new(StatusCode::NO_CONTENT).with_cors_unrestricted());
                 }
                 _ => (),
             },