CORS Pre-flight fails for public resources #301

New Issue

MrUnknownDE · 2026-04-05T17:05:33+02:00

MrUnknownDE commented

2026-04-05 17:05:33 +02:00

Originally created by @Cavamania on 1/29/2026

Describe the Bug

If authorization is enabled on a public resource, the CORS pre-flight request will fail. CORS pre-flight normally doesn't allow extra headers so authentication may fail on the OPTIONS request. There also doesn't seem to be a mechanism to allow the preflight request to bypass auth (e.g. custom rule, CORS settings etc.).

Environment

OS Type & Version: Ubuntu 22.04
Pangolin Version: 1.15.1
Gerbil Version: 1.3.0
Traefik Version: v3.6
Newt Version: v1.9.0

To Reproduce

Start basic API node server
Add a resource with SSO enabled
Create a share link to create an auth token
Make CORS preflight request

Expected Behavior

Preflight requests are allow to pass auth.

*Originally created by @Cavamania on 1/29/2026* ### Describe the Bug If authorization is enabled on a public resource, the CORS pre-flight request will fail. CORS pre-flight normally doesn't allow extra headers so authentication may fail on the OPTIONS request. There also doesn't seem to be a mechanism to allow the preflight request to bypass auth (e.g. custom rule, CORS settings etc.). ### Environment - OS Type & Version: Ubuntu 22.04 - Pangolin Version: 1.15.1 - Gerbil Version: 1.3.0 - Traefik Version: v3.6 - Newt Version: v1.9.0 ### To Reproduce - Start basic API node server - Add a resource with SSO enabled - Create a share link to create an auth token - Make CORS preflight request ### Expected Behavior Preflight requests are allow to pass auth.

MrUnknownDE added the Improvement bug Improvement bug bug bug bug bug labels 2026-04-05 17:05:33 +02:00

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label Improvement Improvement bug bug bug bug bug bug

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#301