From 32737328910108298c468d1ca8de6b9ec52e1a33 Mon Sep 17 00:00:00 2001 From: Teknium <127238744+teknium1@users.noreply.github.com> Date: Sat, 28 Mar 2026 13:38:30 -0700 Subject: [PATCH] fix(api-server): add CORS headers to streaming SSE responses (#3573) StreamResponse headers are flushed on prepare() before the CORS middleware can inject them. Resolve CORS headers up front using _cors_headers_for_origin() so the full set (including Access-Control-Allow-Origin) is present on SSE streams. Co-authored-by: ygd58 --- gateway/platforms/api_server.py | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/gateway/platforms/api_server.py b/gateway/platforms/api_server.py index 11b639c5c..f0dfc6466 100644 --- a/gateway/platforms/api_server.py +++ b/gateway/platforms/api_server.py @@ -582,10 +582,14 @@ class APIServerAdapter(BasePlatformAdapter): """ import queue as _q - response = web.StreamResponse( - status=200, - headers={"Content-Type": "text/event-stream", "Cache-Control": "no-cache"}, - ) + sse_headers = {"Content-Type": "text/event-stream", "Cache-Control": "no-cache"} + # CORS middleware can't inject headers into StreamResponse after + # prepare() flushes them, so resolve CORS headers up front. + origin = request.headers.get("Origin", "") + cors = self._cors_headers_for_origin(origin) if origin else None + if cors: + sse_headers.update(cors) + response = web.StreamResponse(status=200, headers=sse_headers) await response.prepare(request) try: