Reflect requested CORS headers dynamically

server/auth_principal_test.go

@@ -656,7 +656,7 @@ func TestCORSAllowsBrowserSpaceCredentialExchange(t *testing.T) {
 	req := httptest.NewRequest(http.MethodOptions, "/xrpc/com.atproto.space.getSpaceCredential", nil)
 	req.Header.Set(echo.HeaderOrigin, "https://pdsls.dev")
 	req.Header.Set(echo.HeaderAccessControlRequestMethod, http.MethodPost)
-	req.Header.Set(echo.HeaderAccessControlRequestHeaders, "atproto-accept-labelers,authorization,content-type,dpop,x-bsky-topics")
+	req.Header.Set(echo.HeaderAccessControlRequestHeaders, "atproto-accept-labelers,authorization,content-type,dpop,x-bsky-topics,x-future-client-header")
 	rec := httptest.NewRecorder()
 	e.ServeHTTP(rec, req)
 
@@ -670,7 +670,7 @@ func TestCORSAllowsBrowserSpaceCredentialExchange(t *testing.T) {
 		t.Fatalf("allow-credentials = %q, want true", got)
 	}
 	allowHeaders := strings.ToLower(rec.Header().Get(echo.HeaderAccessControlAllowHeaders))
-	for _, want := range []string{"authorization", "content-type", "dpop", "atproto-accept-labelers", "x-bsky-topics"} {
+	for _, want := range []string{"authorization", "content-type", "dpop", "atproto-accept-labelers", "x-bsky-topics", "x-future-client-header"} {
 		if !strings.Contains(allowHeaders, want) {
 			t.Fatalf("allow-headers = %q, missing %q", allowHeaders, want)
 		}

server/server.go

@@ -260,16 +260,8 @@ func cocoonCORSConfig() middleware.CORSConfig {
 		AllowOriginFunc: func(origin string) (bool, error) {
 			return origin != "", nil
 		},
-		AllowHeaders: []string{
-			echo.HeaderOrigin,
-			echo.HeaderAccept,
-			echo.HeaderContentType,
-			echo.HeaderAuthorization,
-			"DPoP",
-			"atproto-proxy",
-			"atproto-accept-labelers",
-			"x-bsky-topics",
-		},
+		// Leave AllowHeaders empty so Echo reflects the browser's requested
+		// headers instead of requiring every client-specific header here.
 		AllowMethods: []string{
 			http.MethodGet,
 			http.MethodHead,