From e813713a09f38966eec8d287526947404f244afd Mon Sep 17 00:00:00 2001
From: Trezy <tre@trezy.com>
Date: Thu, 19 Mar 2026 01:25:57 -0500
Subject: [PATCH] fix: add CORS reflection for auth requests

---
 src/server.rs | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/src/server.rs b/src/server.rs
index 8bfc8aa..6d9fd48 100644
--- a/src/server.rs
+++ b/src/server.rs
@@ -1,5 +1,6 @@
 use axum::extract::{DefaultBodyLimit, State};
 use axum::http::HeaderMap;
+use axum::http::{Method, header};
 use axum::response::{IntoResponse, Response};
 use axum::routing::{get, post};
 use axum::{Json, Router};
@@ -76,7 +77,13 @@ pub fn router(state: AppState) -> Router {
         .route("/config", get(config_endpoint))
         .fallback_service(serve_dir)
         .layer(TraceLayer::new_for_http())
-        .layer(CorsLayer::permissive())
+        .layer(
+            CorsLayer::new()
+                .allow_origin(tower_http::cors::AllowOrigin::mirror_request())
+                .allow_methods([Method::GET, Method::POST, Method::OPTIONS])
+                .allow_headers([header::CONTENT_TYPE, header::AUTHORIZATION, header::COOKIE])
+                .allow_credentials(true),
+        )
         .with_state(state)
 }
 
-- 
2.51.2