From 665aee735b1364058079d51038e6b4d7e7311785 Mon Sep 17 00:00:00 2001
From: Neal Shah <30693865+ProgrammerIn-wonderland@users.noreply.github.com>
Date: Tue, 3 Feb 2026 14:13:42 -0800
Subject: [PATCH] dav.puter.com CORS headers (#2406)

* webdav cors stuff

* if OPTIONS request just let it through
---
 src/backend/src/modules/web/WebServerService.js  | 3 ++-
 src/backend/src/services/WebDAV/WebDAVService.js | 4 ++++
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/src/backend/src/modules/web/WebServerService.js b/src/backend/src/modules/web/WebServerService.js
index 70b8788b8..b4477248d 100644
--- a/src/backend/src/modules/web/WebServerService.js
+++ b/src/backend/src/modules/web/WebServerService.js
@@ -619,7 +619,8 @@ class WebServerService extends BaseService {
             // Website(s) to allow to connect
             if (
                 config.experimental_no_subdomain ||
-                req.subdomains[req.subdomains.length - 1] === 'api'
+                req.subdomains[req.subdomains.length - 1] === 'api' ||
+                req.subdomains[req.subdomains.length - 1] === 'dav'
             ) {
                 res.setHeader('Access-Control-Allow-Origin', origin ?? '*');
             }
diff --git a/src/backend/src/services/WebDAV/WebDAVService.js b/src/backend/src/services/WebDAV/WebDAVService.js
index 1e1e93c3d..41a53100a 100644
--- a/src/backend/src/services/WebDAV/WebDAVService.js
+++ b/src/backend/src/services/WebDAV/WebDAVService.js
@@ -245,6 +245,10 @@ class WebDAVService extends BaseService {
              * @param {import("express").Response} res
              */
             handler: async ( req, res ) => {
+                if ( req.method === 'OPTIONS' ) {
+                    this.handleWebDavServer('/', req, res);
+                    return;
+                }
                 const svc_su = this.services.get('su');
                 let actor = await this.handleHttpBasicAuth(req.actor, req, res);
                 if ( ! actor ) {