github-starred/ollama
2
0
Fork 0
mirror of https://github.com/ollama/ollama.git synced 2026-05-05 23:53:43 -05:00
Code Issues 14.5k Packages Projects Releases 120 Wiki Activity

[PR #13458] fix: add CORS headers to redirect responses #14219

New Issue
Open
opened 2026-04-13 00:48:39 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-13 00:48:39 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/ollama/ollama/pull/13458
Author: @nathannewyen
Created: 12/13/2025
Status: 🔄 Open

Base: main ← Head: fix/cors-redirect-headers

📝 Commits (1)

  • 6d91914 fix: add CORS headers to redirect responses

📊 Changes

2 files changed (+367 additions, -2 deletions)

View changed files

📝 server/routes.go (+84 -2)
➕ server/routes_cors_test.go (+283 -0)

📄 Description

Summary

  • Fixes issue where redirect responses (e.g., 301 from path normalization like //api/tags -> /api/tags) were missing CORS headers
  • Adds a response writer wrapper that ensures Access-Control-Allow-Origin header is present on all responses, including redirects
  • The wrapper respects the existing CORS configuration and only adds headers if they haven't been set by gin-contrib/cors middleware

Problem

When a request triggers a redirect (e.g., from path normalization), the CORS middleware was bypassed because:

  1. Gin's internal path cleanup/redirect mechanism operates at a level below the middleware chain
  2. The redirect response is written before the CORS middleware can intercept it

This caused browsers to block redirect responses with the error:

CORS header 'Access-Control-Allow-Origin' missing

Solution

Added a corsWrapper that wraps the HTTP handler and intercepts all responses:

  • Intercepts WriteHeader and Write calls via a custom corsResponseWriter
  • Checks if CORS headers already exist (to avoid overwriting gin-contrib/cors headers)
  • If missing, adds CORS headers for allowed origins matching the request's Origin header
  • Supports wildcard patterns like http://localhost:*

Test plan

  • Added unit tests for matchOrigin function (pattern matching)
  • Added unit tests for corsResponseWriter (header injection)
  • Added integration tests for corsWrapper (redirect scenario)
  • Verified existing CORS headers are not overwritten
  • All existing tests pass

Fixes #13420

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/ollama/ollama/pull/13458 **Author:** [@nathannewyen](https://github.com/nathannewyen) **Created:** 12/13/2025 **Status:** 🔄 Open **Base:** `main` ← **Head:** `fix/cors-redirect-headers` --- ### 📝 Commits (1) - [`6d91914`](https://github.com/ollama/ollama/commit/6d91914f30023d4f2b01e42ce3d68c8c84a9d5d8) fix: add CORS headers to redirect responses ### 📊 Changes **2 files changed** (+367 additions, -2 deletions) <details> <summary>View changed files</summary> 📝 `server/routes.go` (+84 -2) ➕ `server/routes_cors_test.go` (+283 -0) </details> ### 📄 Description ## Summary - Fixes issue where redirect responses (e.g., 301 from path normalization like `//api/tags` -> `/api/tags`) were missing CORS headers - Adds a response writer wrapper that ensures `Access-Control-Allow-Origin` header is present on all responses, including redirects - The wrapper respects the existing CORS configuration and only adds headers if they haven't been set by gin-contrib/cors middleware ## Problem When a request triggers a redirect (e.g., from path normalization), the CORS middleware was bypassed because: 1. Gin's internal path cleanup/redirect mechanism operates at a level below the middleware chain 2. The redirect response is written before the CORS middleware can intercept it This caused browsers to block redirect responses with the error: > CORS header 'Access-Control-Allow-Origin' missing ## Solution Added a `corsWrapper` that wraps the HTTP handler and intercepts all responses: - Intercepts `WriteHeader` and `Write` calls via a custom `corsResponseWriter` - Checks if CORS headers already exist (to avoid overwriting gin-contrib/cors headers) - If missing, adds CORS headers for allowed origins matching the request's `Origin` header - Supports wildcard patterns like `http://localhost:*` ## Test plan - [x] Added unit tests for `matchOrigin` function (pattern matching) - [x] Added unit tests for `corsResponseWriter` (header injection) - [x] Added integration tests for `corsWrapper` (redirect scenario) - [x] Verified existing CORS headers are not overwritten - [x] All existing tests pass Fixes #13420 --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-04-13 00:48:39 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
amd
api
app
bug
build
cli
cloud
compatibility
context-length
create
docker
documentation
embeddings
feature request
feedback wanted
good first issue
gpt-oss
gpu
harmony
help wanted
image
install
intel
js
launch
linux
macos
memory
mlx
model
needs more info
networking
nvidia
ollama.com
performance
pull-request
Mirrored from GitHub Pull Request
 python
question
registry
rendering
thinking
tools
top
vulkan
windows
wsl
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/ollama#14219
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?