From 31604f623fead73c4a0434cdcb35fc15218b0418 Mon Sep 17 00:00:00 2001 From: sijie-Z Date: Fri, 17 Jul 2026 15:21:28 +0800 Subject: [PATCH] http: add Prefer to CORS Access-Control-Allow-Headers header The rclone web GUI uses the Prefer header for sync/copy operations, but the CORS middleware's preflight response did not include it in Access-Control-Allow-Headers. This caused the browser to block remote GUI copy requests with a CORS policy error: Request header field prefer is not allowed by Access-Control-Allow-Headers in preflight response. Add 'Prefer' to the allowed headers list so remote GUI access works correctly for file copy operations. Fixes #9614 Co-Authored-By: Claude Opus 4.8 --- lib/http/middleware.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/http/middleware.go b/lib/http/middleware.go index 8e58c6bbb..a9ccf4e2e 100644 --- a/lib/http/middleware.go +++ b/lib/http/middleware.go @@ -189,7 +189,7 @@ func MiddlewareCORS(allowOrigin string) Middleware { if allowOrigin != "" { w.Header().Add("Access-Control-Allow-Origin", allowOrigin) - w.Header().Add("Access-Control-Allow-Headers", "Authorization, Content-Type, Depth, Destination, If, Lock-Token, Overwrite, TimeOut, Translate") + w.Header().Add("Access-Control-Allow-Headers", "Authorization, Content-Type, Depth, Destination, If, Lock-Token, Overwrite, Prefer, TimeOut, Translate") w.Header().Add("Access-Control-Allow-Methods", "COPY, DELETE, GET, HEAD, LOCK, MKCOL, MOVE, OPTIONS, POST, PROPFIND, PROPPATCH, PUT, TRACE, UNLOCK") w.Header().Add("Access-Control-Max-Age", "86400") }