From 4b7eddbd3e0b2e7176b4edc00ee58c0dbf019f3e Mon Sep 17 00:00:00 2001 From: efrilm Date: Fri, 9 Oct 2026 22:58:02 +0700 Subject: [PATCH] fix(cors): allow the Idempotency-Key header The EnakGame client runs at its game_url, another origin than the API, so the browser asks before POST /customer/enakgame/sessions. Idempotency-Key was not in Access-Control-Allow-Headers, so the preflight refused it and a play could not start. X-Idempotency-Key, the older name the backend also reads, is allowed too. Co-Authored-By: Claude Opus 5.5 --- internal/middleware/cors.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/internal/middleware/cors.go b/internal/middleware/cors.go index e9b4196..9420bb0 100644 --- a/internal/middleware/cors.go +++ b/internal/middleware/cors.go @@ -12,7 +12,7 @@ func CORS() gin.HandlerFunc { } c.Header("Access-Control-Allow-Origin", origin) c.Header("Access-Control-Allow-Credentials", "true") - c.Header("Access-Control-Allow-Headers", "Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, accept, origin, Cache-Control, X-Requested-With") + c.Header("Access-Control-Allow-Headers", "Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, accept, origin, Cache-Control, X-Requested-With, Idempotency-Key, X-Idempotency-Key") c.Header("Access-Control-Allow-Methods", "POST, OPTIONS, GET, PUT, DELETE") if c.Request.Method == "OPTIONS" {