From 8e4be7898d916b80350b9778525796d1829b70bd Mon Sep 17 00:00:00 2001 From: Stanislav Vasilyev Date: Fri, 25 Sep 2026 00:25:47 +0300 Subject: [PATCH] Add CORS header to public v2 responses Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- src/adsb_api/app.py | 9 +++++++++ tests/test_api.py | 13 +++++++++++++ 2 files changed, 22 insertions(+) diff --git a/src/adsb_api/app.py b/src/adsb_api/app.py index 2196249..f810e13 100644 --- a/src/adsb_api/app.py +++ b/src/adsb_api/app.py @@ -88,6 +88,15 @@ async def get_http_session() -> aiohttp.ClientSession: }, ) + +@app.middleware("http") +async def add_v2_cors_header(request: Request, call_next): + response = await call_next(request) + if request.url.path.startswith("/v2/"): + response.headers["Access-Control-Allow-Origin"] = "*" + return response + + app.include_router(v2_router) app.include_router(routes_router) app.include_router(tar_router) diff --git a/tests/test_api.py b/tests/test_api.py index cd04f32..5e75b89 100644 --- a/tests/test_api.py +++ b/tests/test_api.py @@ -207,6 +207,19 @@ async def test_v2_radius(mock_happy_reapi, test_client): assert resp["msg"] == "No error" +def test_v2_responses_allow_cross_origin_reads(test_client): + response = test_client.get( + "/v2/not-a-route", + headers={"Origin": "https://example.com"}, + ) + + assert response.headers["access-control-allow-origin"] == "*" + assert "access-control-allow-origin" not in test_client.get( + "/docs", + headers={"Origin": "https://example.com"}, + ).headers + + @pytest.mark.asyncio async def test_api_me(test_client): response = test_client.get("/api/0/me")