Émile Ré fbdff595fe Fix CORS and CSRF for cookie banner POST /consents endpoint ...

The cookie banner's cross-origin POST was blocked by two layered issues:

1. The global cors.Handler (with OptionsPassthrough: false) intercepted
   OPTIONS preflights before the cookie banner's own CORS middleware
   could run. Customer website origins aren't in AllowedOrigins, so the
   preflight response had no CORS headers. Move the cookie banner mount
   outside the global CORS group since it handles CORS per-banner.

2. The CSRF bypass patterns used literal "*" instead of ServeMux wildcard
   syntax "{rest...}", so they never matched real request paths like
   POST /cookie-banner/v1/{bannerID}/consents. Also remove redundant
   GET/OPTIONS bypass patterns since safe methods are always allowed.

Signed-off-by: Émile Ré <emile@getprobo.com>

2026-04-22 11:34:49 +04:00

8.5 KiB

Raw Blame History

View Raw