From 0f0c50f7d44c3c3d37dc19bc27bc8e33d8672302 Mon Sep 17 00:00:00 2001 From: Johanna Larsson Date: Fri, 28 Aug 2026 07:33:18 +0100 Subject: [PATCH] Loosen CORS header requirements Bluesky started sending `x-bsky-is-beta-user` for some users on XRPC requests, but tranquil has a strict allowlist of CORS headers. The spec doesn't (?) specify any requirements around CORS headers, so we can avoid trouble when Bluesky make changes by just allowing all headers. This PR replaces the allowlist with the request mirror behavior, where any headers sent on a CORS request are echoed back. This also matches the reference PDS. --- crates/tranquil-pds/src/lib.rs | 15 +-------------- crates/tranquil-pds/src/util.rs | 4 ---- 2 files changed, 1 insertion(+), 18 deletions(-) diff --git a/crates/tranquil-pds/src/lib.rs b/crates/tranquil-pds/src/lib.rs index a3b2bd7..f074b57 100644 --- a/crates/tranquil-pds/src/lib.rs +++ b/crates/tranquil-pds/src/lib.rs @@ -106,20 +106,7 @@ pub fn app_with_routes(state: AppState, external: ExternalRoutes) -> Router { CorsLayer::new() .allow_origin(Any) .allow_methods([Method::GET, Method::POST, Method::OPTIONS]) - .allow_headers(AllowHeaders::list( - [ - http::header::AUTHORIZATION, - http::header::CONTENT_TYPE, - http::header::CONTENT_ENCODING, - http::header::ACCEPT_ENCODING, - http::header::USER_AGENT, - util::HEADER_DPOP, - util::HEADER_ATPROTO_PROXY, - util::HEADER_ATPROTO_ACCEPT_LABELERS, - ] - .into_iter() - .chain(util::CORS_BSKY_ALLOW_HEADERS), - )) + .allow_headers(AllowHeaders::mirror_request()) .expose_headers([ http::header::WWW_AUTHENTICATE, util::HEADER_DPOP_NONCE, diff --git a/crates/tranquil-pds/src/util.rs b/crates/tranquil-pds/src/util.rs index 4492f30..adf9bdb 100644 --- a/crates/tranquil-pds/src/util.rs +++ b/crates/tranquil-pds/src/util.rs @@ -89,10 +89,6 @@ pub const HEADER_ATPROTO_CONTENT_LABELERS: HeaderName = HeaderName::from_static("atproto-content-labelers"); #[cfg(feature = "bsky-support")] pub const HEADER_X_BSKY_TOPICS: HeaderName = HeaderName::from_static("x-bsky-topics"); -#[cfg(feature = "bsky-support")] -pub const CORS_BSKY_ALLOW_HEADERS: [HeaderName; 1] = [HEADER_X_BSKY_TOPICS]; -#[cfg(not(feature = "bsky-support"))] -pub const CORS_BSKY_ALLOW_HEADERS: [HeaderName; 0] = []; pub fn get_header_str( headers: &HeaderMap,