diff --git a/src/backend/src/middleware/configurable_auth.js b/src/backend/src/middleware/configurable_auth.js
index 7133e0fec..f8ca1272a 100644
--- a/src/backend/src/middleware/configurable_auth.js
+++ b/src/backend/src/middleware/configurable_auth.js
@@ -55,7 +55,7 @@ const configurable_auth = options => async (req, res, next) => {
     if(req.body && req.body.auth_token)
         token = req.body.auth_token;
     // HTTML Auth header
-    else if (req.header && req.header('Authorization') && !req.header('Authorization').startsWith("Basic ")) {
+    else if (req.header && req.header('Authorization') && !req.header('Authorization').startsWith("Basic ") && req.header('Authorization') !== "Bearer") { // Bearer with no space is something office does
         token = req.header('Authorization');
         token = token.replace('Bearer ', '').trim();
         if ( token === 'undefined' ) {
diff --git a/src/backend/src/modules/web/WebServerService.js b/src/backend/src/modules/web/WebServerService.js
index 97390352a..c854a6586 100644
--- a/src/backend/src/modules/web/WebServerService.js
+++ b/src/backend/src/modules/web/WebServerService.js
@@ -672,13 +672,13 @@ class WebServerService extends BaseService {
                     'MS-Author-Via': 'DAV',  // Microsoft compatibility
                     'Server': 'Puter/WebDAV',  // Server identification
                     'Accept-Ranges': 'bytes',
+                    "Access-Control-Allow-Credentials": "true",
                     'Content-Type': 'text/plain; charset=utf-8',  // Explicit content type
                     'Content-Length': '0',
                     'Cache-Control': 'no-cache',  // Prevent caching issues
                     'Connection': 'Keep-Alive'  // Keep connection alive for macOS
                 });
                 res.status(200).end();
-                console.log("OPTIONS request completed for macOS compatibility");
             }
             return res.sendStatus(200);
         });
diff --git a/src/backend/src/services/WebDavFS.js b/src/backend/src/services/WebDavFS.js
index fea7b3a62..8308c4aed 100644
--- a/src/backend/src/services/WebDavFS.js
+++ b/src/backend/src/services/WebDavFS.js
@@ -1135,9 +1135,9 @@ class WebDavFS extends BaseService {
              */
             handler: async (req, res) => {
                 const svc_su = this.services.get("su")
+                res.set({ "Access-Control-Allow-Credentials": "true"}) // allow cors auth
                 let actor = await handleHttpBasicAuth(req.actor, req, res);
                 if (!actor) return;
-
                 let filePath = decodeURIComponent(req.path)
                 // Handle root path for WebDAV compatibility
                 if (filePath === "/" || filePath === "") {