mirror of
https://github.com/mudler/LocalAI.git
synced 2026-09-12 14:22:11 -04:00
Leoy
aeac5e86dc
* fix(auth): bypass API-key auth for CORS preflight (OPTIONS) requests When API-key auth is enabled, a browser making a cross-origin API call first sends an OPTIONS CORS preflight, which cannot carry credentials by HTTP spec. The auth middleware is registered (app.go:324) before the CORS middleware (app.go:337-347), so the preflight hit auth first and returned 401 before the CORS middleware could answer it, blocking the actual call. Bypass auth for OPTIONS so the request reaches the CORS middleware, which answers the preflight with 200 + headers. Real API requests (GET/POST/etc.) still require auth. Regression test added (red on master, green on branch). Refs #4576 Signed-off-by: supermario_leo <leo.stack@outlook.com> * fix(auth): exempt CORS preflights via publicRouteRegistry instead of middleware bypass Route the global OPTIONS exemption through publicRouteRegistry (OPTIONS on every path, replacing the OPTIONS-under-/api/auth/ rule it subsumes) instead of a hardcoded method check inside Middleware, so "which requests skip auth" has one mechanism. Preflights now flow through the same authenticate-then-public-rules path as other public routes, which also lets a credentialed OPTIONS request keep its user context. Update the route-coverage allowlist and the near-prefix lookalike table for the new semantics (OPTIONS is public on every path by design; near-prefix privacy stays pinned by the non-OPTIONS entries), and fix the authentication docs' exempt-route enumeration, which still described OPTIONS as an /api/auth/-only exemption. Signed-off-by: supermario_leo <leo.stack@outlook.com> --------- Signed-off-by: supermario_leo <leo.stack@outlook.com>