Skip to content

fix(desktop): extend CORS workaround to cover Access-Control-Allow-Headers #9753

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ricardo777 wants to merge 1 commit into
base: main
Choose a base branch
from
Open

fix(desktop): extend CORS workaround to cover Access-Control-Allow-Headers #9753

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions desktop/src/main.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -670,6 +670,8 @@ const allowAllCORSOrigins = (webContents: WebContents) =>
if (key.toLowerCase() == "access-control-allow-origin") {
headers["Access-Control-Allow-Origin"] =
value[0] == "null" ? ["*"] : value;
} else if (key.toLowerCase() == "access-control-allow-headers") {
headers["Access-Control-Allow-Headers"] = ["*"];
Comment on lines +673 to +674
Copy link
Copy Markdown

@chatgpt-codex-connector chatgpt-codex-connector bot Mar 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Preserve explicit ACAH values for checkout traffic

allowAllCORSOrigins now rewrites every Access-Control-Allow-Headers header to *, but this same webContents session is also used for in-app Stripe checkout, and the adjacent comment already documents credentialed XHRs from that flow (desktop/src/main.ts:647-657). For credentialed preflights, browsers do not accept Access-Control-Allow-Headers: *, so a response that previously had a correct explicit allow-list can be turned into an invalid preflight response here, breaking payments again. This needs the same kind of conditional handling as the ACAO workaround instead of unconditionally replacing the server value.

Useful? React with 👍 / 👎.

Copy link
Copy Markdown
Author

@ricardo777 ricardo777 Mar 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

One follow-up question: FileLu returns a valid but incomplete list (e.g. missing x-client-version). The "null" check won't cover that case. Should we also override when the response ACAH doesn't include all requested headers from Access-Control-Request-Headers?

} else {
headers[key] = value;
}
Expand Down