Allow credentialed cross-origin API requests

2026-04-14 11:17:28 +08:00 · 2026-03-17 18:16:52 +08:00
parent 4edfe8e2f0
commit ceb34d6c7e
2 changed files with 4 additions and 0 deletions
--- a/pkg/api/server.go
+++ b/pkg/api/server.go
@@ -245,6 +245,7 @@ func (s *Server) withCORS(next http.Handler) http.Handler {
 		} else {
 			w.Header().Set("Access-Control-Allow-Origin", "*")
 		}
+		w.Header().Set("Access-Control-Allow-Credentials", "true")
 		allowMethods := strings.TrimSpace(r.Header.Get("Access-Control-Request-Method"))
 		if allowMethods == "" {
 			allowMethods = "GET, POST, PUT, PATCH, DELETE, OPTIONS"