aaronrene / knowtation public
fix patch feat/phase-2g-bundle
AI Agent git-import/068377df · 107 days ago · Apr 10, 2026 · Diff

fix: strip upstream CORS headers in gateway proxy — canister CORS was overwriting gateway CORS

The gateway's proxy forwarded all upstream response headers including Access-Control-Allow-Origin from the canister. After the Phase 3 CORS lock set the canister origin to the gateway URL, proxied responses reached the browser with the wrong origin, causing CORS rejection for all API calls from knowtation.store.

Fix: strip all access-control-* headers from upstream (canister/bridge) responses. The gateway's own CORS middleware is the sole authority for browser CORS headers.

Also includes: Hub UI reads token from #fragment, signed image proxy token, invite_accepted from hash.

sha256:733ac70b996aeeebd593bc896c105b2216275f6f3b5039e853e0fb939e099352 sha
sha256:f03730c18e88700b0328353dab7c37471a1c938d3b66f5c78aae07970be17044 parent
sha256:66776316662e938dd6a557d830955998fe08a8229615fa2576e96a09ac21d21f snapshot
← Older Oldest on feat/phase-2g-bundle
All commits
Newer → Latest on feat/phase-2g-bundle

0 comments

No comments yet. Be the first to start the discussion.

To add a comment, use the Muse CLI: muse hub commit comment sha256:733ac70b996aeeebd593bc896c105b2216275f6f3b5039e853e0fb939e099352 --body "your comment"