fix(CORS): add X-Requested-With to Access-Control-Request-Headers (#5009)

allows clients with `X-Requested-With` header to succeed with their CORS request
2025-08-12 00:27:31 +00:00 · 2023-01-09 13:37:10 +01:00
parent 5651f98600
commit 0a30e39b46
4 changed files with 33 additions and 22 deletions
--- a/internal/api/http/middleware/cors_interceptor.go
+++ b/internal/api/http/middleware/cors_interceptor.go
@@ -20,6 +20,7 @@ var (
 			http_utils.ZitadelOrgID,
 			http_utils.XUserAgent,
 			http_utils.XGrpcWeb,
+			http_utils.XRequestedWith,
 		},
 		AllowedMethods: []string{
 			http.MethodOptions,