mirror of
https://github.com/luxfi/graph.git
synced 2026-09-24 00:26:07 +00:00
zeekayandHanzo Dev
c8725690c3
The allow-list named Content-Type and nothing else, and a browser refuses the entire request over one header missing from it. The exchange sends x-api-key, so every call to /v1/quote and /v1/swappable_tokens failed its preflight and the swap panel had neither a token list nor a price. A literal "*" is not the fix. Safari does not honour the wildcard in this header and refuses in exactly the same way — which is how a header set to "*" elsewhere in this stack still produced "x-api-key is not allowed by Access-Control-Allow-Headers". Echoing the request's own Access-Control-Request-Headers is precise, needs no maintenance as clients add headers, and every browser understands it. Co-authored-by: Hanzo Dev <[email protected]>