From 7698a6f9b81349436d0ae8f581e131cb0c7ec466 Mon Sep 17 00:00:00 2001 From: Trong Huu Nguyen Date: Wed, 5 Feb 2025 11:31:24 +0100 Subject: [PATCH] fix(router): only apply cors for forward-auth --- pkg/router/router.go | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) diff --git a/pkg/router/router.go b/pkg/router/router.go index dc0da2b..1cf916d 100644 --- a/pkg/router/router.go +++ b/pkg/router/router.go @@ -82,15 +82,9 @@ func New(src Source, cfg *config.Config) chi.Router { for _, prefix := range prefixes { r.Route(prefix+paths.OAuth2, func(r chi.Router) { r.Group(func(r chi.Router) { - // Middlewares must be defined before routes. - needsCors := cfg.SSO.IsServer() - if needsCors { - r.Use(cors(http.MethodGet, http.MethodHead)) - } if cfg.Session.ForwardAuth { + r.Use(cors(http.MethodGet, http.MethodHead)) r.Use(httpinternal.DisallowNonNavigationalRequests) - } - if needsCors { // Cors middleware is designed to be used as a top-level middleware on the chi router. // Applying with within a r.Group() or using With() will not work without routes matching OPTIONS added. r.Options(paths.Login, noopHandler)