gofix/portal-tunnel-rs
Watch
1
0
Fork
You've already forked portal-tunnel-rs
 0
Code Issues Pull requests Projects Releases 22 Packages 1 Wiki Activity Actions

fix(api): serve certificate chain with CORS headers #109

Merged
ada merged 1 commit from fix/certificate-chain-cors into master 2026-10-08 16:15:15 +00:00
Conversation 0 Commits 1 Files changed 1 +15 -7
ada commented 2026-10-08 16:10:41 +00:00
Collaborator

Problem

The v2.6 browser/WASM client fetches /sdk/certificate-chain cross-origin before keyless registration. Upstream (utils.HandleAPICORS) sets CORS headers on every API path; the Rust relay returned this success response without Access-Control-Allow-Origin, so browsers blocked it (blocked by CORS policy) and the WASM client retried forever without registering. Found by the public live gate for v2.6.0+rs.1-dev.2 and reproduced against the exact published image in an isolated loopback container.

Change

Wrap the certificate-chain success reply in with_cors, matching every other API reply.

Validation

  • Extended certificate_chain_returns_only_current_listener_public_certs to assert the CORS header; it failed before the fix and passes after.
  • cargo fmt --check clean.

Risk

None beyond adding a CORS header to a public, read-only certificate response.

## Problem The v2.6 browser/WASM client fetches `/sdk/certificate-chain` cross-origin before keyless registration. Upstream (`utils.HandleAPICORS`) sets CORS headers on every API path; the Rust relay returned this success response without `Access-Control-Allow-Origin`, so browsers blocked it (`blocked by CORS policy`) and the WASM client retried forever without registering. Found by the public live gate for `v2.6.0+rs.1-dev.2` and reproduced against the exact published image in an isolated loopback container. ## Change Wrap the certificate-chain success reply in `with_cors`, matching every other API reply. ## Validation - Extended `certificate_chain_returns_only_current_listener_public_certs` to assert the CORS header; it failed before the fix and passes after. - `cargo fmt --check` clean. ## Risk None beyond adding a CORS header to a public, read-only certificate response.
fix(api): serve certificate chain with CORS headers
All checks were successful
Rust CI / Format, lint, and test (pull_request) Successful in 3m5s
Details
Rust CI / Build and start linux/arm64 image (no push) (pull_request) Successful in 56s
Details
0b9fc42b47 
The v2.6 browser/WASM client fetches /sdk/certificate-chain cross-origin before keyless registration. Upstream serves every API path with CORS headers; the Rust relay omitted them on this success response, so browsers blocked the request and the WASM client never registered.
ada merged commit ec663de48a into master 2026-10-08 16:15:15 +00:00
ada deleted branch fix/certificate-chain-cors 2026-10-08 16:15:15 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
gofix/portal-tunnel-rs!109
No description provided.