Allow CORS requests in /.well-known/* routes (#5717)

* Allow CORS requests in /.well-known/* routes

* Fix bug

1 files changed, 16 insertions, 1 deletions

diff --git a/src/server/well-known.ts b/src/server/well-known.ts
index 63837a9b70..08fe3e88f6 100644
--- a/src/server/well-known.ts
+++ b/src/server/well-known.ts
@@ -19,10 +19,25 @@ const XRD = (...x: { element: string, value?: string, attributes?: Record<string
 		typeof value === 'string' ? `>${escapeValue(value)}</${element}` : '/'
 	}>`).reduce((a, c) => a + c, '')}</XRD>`;
 
+const allPath = '/.well-known/*';
 const webFingerPath = '/.well-known/webfinger';
 const jrd = 'application/jrd+json';
 const xrd = 'application/xrd+xml';
 
+router.use(allPath, async (ctx, next) => {
+	ctx.set({
+		'Access-Control-Allow-Headers': 'Accept',
+		'Access-Control-Allow-Methods': 'GET, OPTIONS',
+		'Access-Control-Allow-Origin': '*',
+		'Access-Control-Expose-Headers': 'Vary',
+	});
+	await next();
+});
+
+router.options(allPath, async ctx => {
+	ctx.status = 204;
+});
+
 router.get('/.well-known/host-meta', async ctx => {
 	ctx.set('Content-Type', xrd);
 	ctx.body = XRD({ element: 'Link', attributes: {
@@ -123,7 +138,7 @@ router.get(webFingerPath, async ctx => {
 });
 
 // Return 404 for other .well-known
-router.all('/.well-known/*', async ctx => {
+router.all(allPath, async ctx => {
 	ctx.status = 404;
 });