fix: don't overwrite preflight

litestar-org · Mar 7, 2024 · d699465 · d699465
1 parent d93da82
commit d699465
Showing 1 changed file with 5 additions and 2 deletions.
diff --git a/litestar/middleware/cors.py b/litestar/middleware/cors.py
@@ -70,10 +70,13 @@ async def wrapped_send(message: Message) -> None:
                     headers["Access-Control-Allow-Origin"] = origin
                     headers["Vary"] = "Origin"
 
-                if self.config.allow_headers:
+                # We don't want to overwrite this for preflight requests.
+                allow_headers = headers.get("Access-Control-Allow-Headers")
+                if not allow_headers and self.config.allow_headers:
                     headers["Access-Control-Allow-Headers"] = ", ".join(sorted(set(self.config.allow_headers)))
 
-                if self.config.allow_methods:
+                allow_methods = headers.get("Access-Control-Allow-Methods")
+                if not allow_methods and self.config.allow_methods:
                     headers["Access-Control-Allow-Methods"] = ", ".join(sorted(set(self.config.allow_methods)))
 
             await send(message)