fix(deploy): answer CORS preflight OPTIONS from a worker script#194
Merged
Conversation
The Cloudflare asset layer serves GET/HEAD only and returns 405 to every other method — including the OPTIONS preflights browsers send because maticjs attaches Content-Type to its GETs of /network/.../index.json. A failed preflight blocks the GET, so since the Jul 8 DNS swap every browser consumer of maticjs (staking-ui My Account + write flows, portal bridge flows, third-party apps) fails at StakingClient.init(). Add a minimal worker entry that answers OPTIONS with 204 and the allow-headers the old nginx origin advertised (Content-Type, Authorization), delegating everything else to the assets binding. run_worker_first is required: verified with wrangler dev that without it the asset layer 405s OPTIONS on asset-matched paths before the worker runs. Also corrects the _headers comment that called the allow-headers cargo-cult — maticjs genuinely needs them. Verified locally via wrangler dev: OPTIONS → 204 with full preflight headers; asset GET → 200 with _headers CORS + Cache-Control intact; missing path → 404. Claude-Session: https://claude.ai/code/session_019bL7UgsRRhAC15kxdH3q2y
|
MaximusHaximus
marked this pull request as ready for review
July 9, 2026 08:37
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The static-assets layer serves GET/HEAD only and returns 405 to every other method — including the preflight
OPTIONSbrowsers send before a GET that carries aContent-Typeheader. maticjs sends that header when fetching/network/<network>/<version>/index.json, so the failed preflight blocks the request and client initialisation fails in every browser. The previous nginx origin answeredOPTIONSwith 204 and allowedContent-Type/Authorization.Fix
A minimal worker entry (
worker/worker.ts) answersOPTIONSwith204and the CORS preflight headers, and delegates everything else to the assets binding —_headersandnot_found_handlingstill apply, so GET behaviour is unchanged.run_worker_first = trueis required: with default routing the asset layer answersOPTIONSon asset-matched paths itself (405) before the worker runs (verified withwrangler dev).Supporting changes:
main+ASSETSbinding inwrangler.toml,worker/tsconfig.jsonplus the@cloudflare/workers-typesdevDep,tsconfigRootDirineslint.config.js(the repo now has two tsconfig roots), and doc touch-ups.Verification (local
wrangler dev)OPTIONS /network/mainnet/v1/index.json(Access-Control-Request-Headers: content-type)204+ full preflight header setGET /network/mainnet/v1/index.json200,_headersCORS +Cache-ControlintactGET /200GET /network/nope/v1/index.json404Deploy notes
Merge auto-deploys staging; production is a manual
workflow_dispatchofdeploy.yml.https://claude.ai/code/session_019bL7UgsRRhAC15kxdH3q2y