Send CORS header with non-200 HTTP statuses too

[notramo]

Describe the Bug

api-gateway.umami.dev does not return an Access-Control-Allow-Origin header.

Database

Umami Cloud

Relevant log output

Umami Cloud

Which Umami version are you using? (if relevant)

Umami Cloud

Which browser are you using? (if relevant)

Firefox

How are you deploying your application? (if relevant)

Umami Cloud

[mikecao]

How are you sending your request? The header is there.

[hisune]

I feel the same. It seems that it's not because of CORS; it’s due to the API data HTTP response error 500.

[notramo]

Turns out, it was incorrectly configured, and HTTP 400 was returned, but since it does not have CORS headers, Firefox devtools indicated the CORS errors in a way that it was grabbing attention more than the 400 error.

I would still recommend sending CORS headers with HTTP errors, to not confuse CORS error with the real error.