Jon Saad-FalconandGitHub 3f257f58aa fix: security middleware blocks CORS preflight, breaking desktop chat (#53) ...

The SecurityHeadersMiddleware ran before CORSMiddleware (Starlette
executes middleware in LIFO order) and added headers to OPTIONS
preflight requests. The Content-Security-Policy: default-src 'self'
header told the browser to reject cross-origin connections, so fetch()
from the Tauri webview (https://tauri.localhost) to the API server
(http://127.0.0.1) was blocked — causing "Failed to get response" on
every chat message in the desktop app.

Two fixes:
- Skip security headers on OPTIONS requests so CORS preflight works
- Remove Content-Security-Policy from API responses — it is a
  document-level browser policy irrelevant to JSON API responses and
  breaks any cross-origin API consumer

2026-03-13 20:14:32 -07:00

..

__init__.py

init commit

2026-03-12 17:29:39 +00:00

test_agent_manager_routes.py

init commit

2026-03-12 17:29:39 +00:00

test_api_routes.py

init commit

2026-03-12 17:29:39 +00:00

test_channel_routes.py

init commit

2026-03-12 17:29:39 +00:00

test_middleware.py

fix: security middleware blocks CORS preflight, breaking desktop chat (#53)

2026-03-13 20:14:32 -07:00

test_models_pydantic.py

init commit

2026-03-12 17:29:39 +00:00

test_pwa_serving.py

init commit

2026-03-12 17:29:39 +00:00

test_routes.py

init commit

2026-03-12 17:29:39 +00:00

test_speech_routes.py

init commit

2026-03-12 17:29:39 +00:00

test_websocket.py

init commit

2026-03-12 17:29:39 +00:00

test_ws_bridge.py

init commit

2026-03-12 17:29:39 +00:00