CORS for 'GET' attachment or assets are not working

[derekhu]

Gitea Version

1.15.2

Operating System

Windows

How are you running Gitea?

Localhost

Can you reproduce the bug on the Gitea demo site?

Yes

Description

CORS both for 'POST/PATCH' API and for 'GET' attachment or assets are not working

Access to XMLHttpRequest at 'http://localhost:330/attachments/b95d46d2-8fe9-4529-8bde-c5bddfe08286' from 
origin 'https://hoppscotch.io' has been blocked by CORS policy: 
Response to preflight request doesn't pass access control check: It does not have HTTP ok status.

I am building a PWA and using REST API get access to issues and comments of self hosted Gitea. There are servial issues about CORS:

1. CORS works only for 'GET' method. And never set ’Access-Control-Allowed-Origin: *‘ for 'POST', 'PATCH' etc.
   // after using a chrome extension 'Corss Domain', it adds the response headers ’Access-Control-Allowed-Origin: *‘ for 'POST', 'PATCH', and my PWA works.

2. CORS works only for REST API not for ASSETS.
   As we known, CORS http method call after an 'OPTIONS' prelight request. However, 'OPTIONS’ method was not allowed for attachement assets request. It just return '405 method not allowed' while I access to the resource CORS way, using the right token.
   // I have not found a Chrome extension to fix the reponse code for options access to assets yet.
   // so the issue blocked.

Gitlab API provides the right response code and headers about CORS API access from different domains.

Hoping Gitea can improve the CORS implements and configration.

Screenshots

[noerw]

Ad 1: Are you talking about API routes? A specific one or all? For frontend routes I'm pretty sure this is on purpose as a hardening measure.
Ad 2: that sounds like another CORS regression from the migration to chi to me

[derekhu]

Ad 1: Are you talking about API routes? A specific one or all? For frontend routes I'm pretty sure this is on purpose as a hardening measure. Ad 2: that sounds like another CORS regression from the migration to chi to me

Not frontend routes. Some facts below:

1. I am using Gitea through REST API.
2. I call the REST API from browser, in another hosted domain, in a PWA applicaiton.
3. So, that is : calling gitea REST API iin another domain in browser
4. I am using API token for access.
5. CORS headers works fine for 'GET‘ (reading method) but not working for 'PATCH', 'PUT', 'DELETE' (writing method)
6. 'GET' assets (not api call) doesn't provide CORS headers neither.

Gitlab API works fine in the same scenes ablove.

How to replay it ?

1. Gen an API token from Gitea profile
2. Use https://hoppscotch.io/
3. Access the Gitea REST API using the token gen in step 1)
4. See errors in browser.
5. Explain： Take hoppscotch.io as domain A, and Gitea is domain B ( localhost etc). And gitea's CORS config is on.

Thank you for reply,