From 12ed38dfdda811ba69767a41239f58fb883c3063 Mon Sep 17 00:00:00 2001
From: Muki Kiboigo <muki@muki.gg>
Date: Tue, 25 Aug 2026 17:36:45 -0700
Subject: [PATCH] better no cors opaque behavior

---
 src/browser/webapi/net/Fetch.zig | 2 +-
 src/network/CorsGate.zig         | 4 ++--
 src/network/HttpClient.zig       | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/browser/webapi/net/Fetch.zig b/src/browser/webapi/net/Fetch.zig
index 74f50bac3..f1212e3fa 100644
--- a/src/browser/webapi/net/Fetch.zig
+++ b/src/browser/webapi/net/Fetch.zig
@@ -178,7 +178,7 @@ fn httpHeaderDoneCallback(transfer: *Transfer) !Transfer.HeaderResult {
 
     // no-cors mode: regardless of what the server returned, JS only ever sees
     // an opaque response — status 0, no headers, no body, url "".
-    if (self._no_cors) {
+    if (self._no_cors and transfer.client.obey_cors and transfer._cors_cross_origin) {
         res._status = 0;
         res._status_text = "";
         res._url = "";
diff --git a/src/network/CorsGate.zig b/src/network/CorsGate.zig
index 31c4b65cd..bff3060cc 100644
--- a/src/network/CorsGate.zig
+++ b/src/network/CorsGate.zig
@@ -190,6 +190,8 @@ pub fn check(self: *CorsGate, transfer: *Transfer) !Result {
     const origin = req.origin orelse "null";
     try transfer.setHeader(ORIGIN, origin, .{});
 
+    transfer._cors_cross_origin = true;
+
     if (req.request_mode == .no_cors) {
         log.debug(.cors, "cross origin", .{
             .url = req.url,
@@ -199,8 +201,6 @@ pub fn check(self: *CorsGate, transfer: *Transfer) !Result {
         return .allowed;
     }
 
-    transfer._cors_cross_origin = true;
-
     if (!requiresPreflight(transfer)) {
         log.debug(.cors, "cross origin", .{
             .url = req.url,
diff --git a/src/network/HttpClient.zig b/src/network/HttpClient.zig
index 4128238ed..24b07e335 100644
--- a/src/network/HttpClient.zig
+++ b/src/network/HttpClient.zig
@@ -1706,7 +1706,7 @@ fn processOneMessage(self: *Client, msg: http.Handles.MultiMessage, transfer: *T
     try transfer.materializeResponse(msg.conn, .{});
 
     // Validate the headers for the response with CORS.
-    if (transfer._cors_cross_origin) {
+    if (transfer._cors_cross_origin and transfer.req.request_mode == .cors) {
         CorsGate.validateResponse(transfer) catch |err| {
             self.removeConn(msg.conn);
             transfer._conn = null;