# fix\(server\): allow protocol negotiation in CORS · stienswout/t3code

[View on GitCafe](https://git.cafe/stienswout/t3code/commit/f4b285b8a7dc9025e411d987b7777b9bbbbd2b69)

Repository: [stienswout/t3code](https://git.cafe/stienswout/t3code)

Visibility: public

Requested revision: f4b285b8a7dc9025e411d987b7777b9bbbbd2b69

Requested commit: f4b285b8a7dc9025e411d987b7777b9bbbbd2b69

Commit: f4b285b8a7dc9025e411d987b7777b9bbbbd2b69

Tree: f99595e548f58114c28a2ce16181b65475f3ddd5

Author: Julius Marminge

Committer: Julius Marminge

## Message

```
fix(server): allow protocol negotiation in CORS

Permit the canonical orchestration protocol header in browser API preflights so cross-origin web and desktop clients can negotiate compatibility while retaining authorization and DPoP headers.

Finding: D03

Model: GPT-5.6 Sol via Codex

```

## Parents

- [8c3e834b562d3e69841421fafd59cc86326d860d](https://git.cafe/stienswout/t3code/commit/8c3e834b562d3e69841421fafd59cc86326d860d?format=markdown)

[Source at this commit](https://git.cafe/stienswout/t3code/tree/f4b285b8a7dc9025e411d987b7777b9bbbbd2b69?format=markdown)