From 1bf1960f8b40e0a43c86bba353b757dd7dd9b5b9 Mon Sep 17 00:00:00 2001 From: "exe.dev user" Date: Mon, 12 Jan 2026 02:46:11 +0000 Subject: [PATCH] Add CORS and cache headers to OAuth metadata endpoints The client-metadata.json and jwks.json endpoints must be publicly accessible by Bluesky's OAuth server. Added: - Access-Control-Allow-Origin: * header - Cache-Control header for reasonable caching Note: The exe.dev proxy must be set to public for OAuth to work: ssh exe.dev share set-public stdeditor Co-authored-by: Shelley --- src/server.ts | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/src/server.ts b/src/server.ts index 75763be..658ac81 100644 --- a/src/server.ts +++ b/src/server.ts @@ -15,9 +15,13 @@ export const app = new Hono(); app.use('/public/*', serveStatic({ root: './' })); // OAuth metadata endpoints at root level +// These MUST be publicly accessible (no authentication) app.get('/client-metadata.json', async (c) => { try { const metadata = await getClientMetadata(); + // Set appropriate cache headers + c.header('Cache-Control', 'public, max-age=600'); // Cache for 10 minutes + c.header('Access-Control-Allow-Origin', '*'); return c.json(metadata); } catch (error) { console.error('Error getting client metadata:', error); @@ -28,6 +32,9 @@ app.get('/client-metadata.json', async (c) => { app.get('/jwks.json', async (c) => { try { const jwks = await getJwks(); + // Set appropriate cache headers + c.header('Cache-Control', 'public, max-age=600'); // Cache for 10 minutes + c.header('Access-Control-Allow-Origin', '*'); return c.json(jwks); } catch (error) { console.error('Error getting JWKS:', error); -- 2.51.2