fix(hub): add PATCH to CORS allowMethods so session rename works (#391)

The rename endpoint uses PATCH /api/sessions/:id, but the CORS
middleware only allowed GET, POST, DELETE, OPTIONS. Browsers send a
preflight OPTIONS request for PATCH; without it in allowMethods the
preflight fails and the request never reaches the handler, causing
"Failed to rename" in the web UI every time.

via [HAPI](https://hapi.run)

Co-authored-by: HAPI <noreply@hapi.run>
This commit is contained in:
Haoqing Wang
2026-04-05 12:32:53 +08:00
committed by GitHub
co-authored by HAPI
parent 139a21c66f
commit f970072f66
+1 -1
View File
@@ -77,7 +77,7 @@ function createWebApp(options: {
const corsOriginOption = corsOrigins.includes('*') ? '*' : corsOrigins const corsOriginOption = corsOrigins.includes('*') ? '*' : corsOrigins
const corsMiddleware = cors({ const corsMiddleware = cors({
origin: corsOriginOption, origin: corsOriginOption,
allowMethods: ['GET', 'POST', 'DELETE', 'OPTIONS'], allowMethods: ['GET', 'POST', 'PATCH', 'DELETE', 'OPTIONS'],
allowHeaders: ['authorization', 'content-type'] allowHeaders: ['authorization', 'content-type']
}) })
app.use('/api/*', corsMiddleware) app.use('/api/*', corsMiddleware)