cors

src/server.ts

@@ -33,10 +33,24 @@ export async function createServer(config: BridgeConfig): Promise<BridgeServer>
   });
   const coordinator = new RequestCoordinator();
 
-  app.addHook("onRequest", async (_request, reply) => {
+  app.addHook("onRequest", async (request, reply) => {
+    const requestedHeaders = request.headers["access-control-request-headers"];
+
     reply.raw.setHeader("Access-Control-Allow-Origin", "*");
-    reply.raw.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization");
-    reply.raw.setHeader("Access-Control-Allow-Methods", "POST, OPTIONS");
+    reply.raw.setHeader(
+      "Access-Control-Allow-Headers",
+      requestedHeaders || "Content-Type, Authorization, dangerously-allow-browser",
+    );
+    reply.raw.setHeader("Access-Control-Allow-Methods", "GET, POST, DELETE, OPTIONS");
+    reply.raw.setHeader("Access-Control-Max-Age", "600");
+    reply.raw.setHeader(
+      "Vary",
+      "Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Access-Control-Request-Private-Network",
+    );
+
+    if (request.headers["access-control-request-private-network"] === "true") {
+      reply.raw.setHeader("Access-Control-Allow-Private-Network", "true");
+    }
   });
 
   app.options("/*", async (_request, reply) => reply.status(204).send());