Skip to content

fix(ingest): allow user-agent in the CORS preflight - #1337

Open
JeremyFunk wants to merge 1 commit into
mainfrom
fix/ingest-cors-allow-user-agent
Open

fix(ingest): allow user-agent in the CORS preflight#1337
JeremyFunk wants to merge 1 commit into
mainfrom
fix/ingest-cors-allow-user-agent

fix(ingest): allow user-agent in the CORS preflight

187f3b3
Select commit
Loading
Failed to load commit list.
Maple Review Bot / Maple / review succeeded Oct 8, 2026 in 33s

Confidence 9/10 · No issues found

🟢 Confidence 9/10 · safe to merge
The gateway change is one constant in an existing allow-list; only the CLI mirror has a test, the Rust side rests on the author's browser measurement.
quality 100/100 · no findings · tests partial · risk low

Adds user-agent to the ingest gateway's and the CLI local-mode CORS allow-header lists, plus the matching docs and comment wording. Contained, no behavior beyond preflight acceptance; safe to merge.

  • CorsLayer.allow_headers in apps/ingest/src/main.rs now allows USER_AGENT
  • corsHeadersForAllowedOrigin in apps/cli/src/server/serve.ts lists user-agent
  • Docs and the SDK_HINT_HEADER comment stop claiming no browser sends it
What was checked
  • user-agent is only added to response Access-Control-Allow-Headers; no server-side gate reads it, and record_client_identity merely records it (apps/ingest/src/main.rs:3040)
  • The effect-sdk really does set the header on every OTLP request, so the Firefox preflight failure it describes is reachable (packages/effect-sdk/src/shared/flush-core.ts:90)
  • Origins, methods, exposed headers and layer ordering are unchanged; the CLI exact-header assertion is updated to match (apps/cli/test/server-network.test.ts:229)

187f3b3 · Updated on every push. Reply "won't fix" to dismiss a finding, or mention @maple-review-bot to ask about one.

View more details on Maple Review Bot