From 1ae01f3fc2bea9dda78f29fad6ee3ab0ea140e38 Mon Sep 17 00:00:00 2001 From: Muki Kiboigo Date: Wed, 23 Sep 2026 08:00:45 -0700 Subject: [PATCH] check creds grant if non-creds is missing in CorsGate --- src/network/CorsGate.zig | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/src/network/CorsGate.zig b/src/network/CorsGate.zig index ee01c975d..8978edf96 100644 --- a/src/network/CorsGate.zig +++ b/src/network/CorsGate.zig @@ -220,11 +220,21 @@ pub fn check(self: *CorsGate, transfer: *Transfer) !Result { const wants_credentials = req.credentials_mode == .include; const authored = try collectAuthoredHeaders(transfer, transfer.arena.allocator()); - if (try self.network.cors_store.covers(.{ + + var covered = try self.network.cors_store.covers(.{ .origin = origin, .target = req.url, .credentials = wants_credentials, - }, req.method, authored.items)) { + }, req.method, authored.items); + if (!covered and !wants_credentials) { + covered = try self.network.cors_store.covers(.{ + .origin = origin, + .target = req.url, + .credentials = true, + }, req.method, authored.items); + } + + if (covered) { log.debug(.cors, "cross origin", .{ .url = req.url, .origin = origin,