Fix HTTP: Use permissive CORS headers for .well-known endpoints

2026-05-08 08:06:18 +02:00
parent 52f366454b
commit af583c19c1
6 changed files with 26 additions and 7 deletions
--- a/crates/http/src/auth/oauth/auth.rs
+++ b/crates/http/src/auth/oauth/auth.rs
@@ -456,6 +456,7 @@ impl OAuthApiHandler for Server {
            code_challenge_methods_supported: &["S256"],
            issuer: base_url.to_string(),
        })
-        .into_http_response())
+        .into_http_response()
+        .with_cors_unrestricted())
    }
 }
--- a/crates/http/src/auth/oauth/openid.rs
+++ b/crates/http/src/auth/oauth/openid.rs
@@ -99,6 +99,7 @@ impl OpenIdHandler for Server {
            code_challenge_methods_supported: &["S256"],
            issuer: base_url.to_string(),
        })
-        .into_http_response())
+        .into_http_response()
+        .with_cors_unrestricted())
    }
 }