Skip to content

Fix CORS headers missing on error responses in desktop app #272

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Mng-dev-ai merged 2 commits into from
Feb 22, 2026
Merged

Fix CORS headers missing on error responses in desktop app #272

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
40e0db8
Fix CORS headers missing on error responses in Tauri desktop app
Mng-dev-ai Feb 22, 2026
37b7d11
Narrow session invalidation to 401 only
Mng-dev-ai Feb 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions backend/app/core/middleware.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -149,6 +149,9 @@ async def _global_exception_handler(request: Request, exc: Exception) -> JSONRes

def setup_middleware(app: FastAPI) -> None:

session_secret = settings.SESSION_SECRET_KEY or settings.SECRET_KEY
app.add_middleware(SessionMiddleware, secret_key=session_secret)

app.add_middleware(SecurityHeadersMiddleware)
app.add_middleware(RequestIdMiddleware)

Expand All @@ -168,9 +171,6 @@ def setup_middleware(app: FastAPI) -> None:
expose_headers=["X-Message-Id", "X-Request-ID", "X-Process-Time"],
)

session_secret = settings.SESSION_SECRET_KEY or settings.SECRET_KEY
app.add_middleware(SessionMiddleware, secret_key=session_secret)

app.add_exception_handler(ServiceException, _service_exception_handler)
app.add_exception_handler(StarletteHTTPException, _http_exception_handler)
app.add_exception_handler(Exception, _global_exception_handler)
15 changes: 3 additions & 12 deletions frontend/src/lib/api.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -87,19 +87,10 @@ async function refreshTokenIfNeeded(baseURL: string): Promise<TokenResponse> {
}
}

// Desktop reinstalls can leave stale refresh tokens in local storage while the backend
// identity/session store resets. Treat refresh 401 as terminal to break retry loops.
function shouldInvalidateSession(error: unknown): boolean {
if (!(error instanceof RefreshTokenError)) {
return false;
}
if (error.status === 0) {
return false;
}
if (error.status >= 500) {
return false;
}
// Desktop reinstalls can leave stale refresh tokens in local storage while the backend
// identity/session store resets. Treat refresh 4xx as terminal to break retry loops.
return error.status >= 400 && error.status < 500;
return error instanceof RefreshTokenError && error.status === 401;
}

const extractErrorMessage = async (response: Response): Promise<string> => {
Expand Down
Loading