Question supertokens React SDK: Does anybody know where the SDK makes the modifications to Access-Control-Request-Headers to add "st-auth-mode"? I'm not 100% but there might be a bug in there when working with fastapi. Here is my reasoning: 1. I get a 400 on OPTIONS when trying to do a POST. The usual CORS, not allowed blah blah blah 2. FastApi is setup the same way as the recipe: allow_headers=["Content-Type"] + get_all_cors_headers(), With the above config, fastapi will respond with: Accept, Accept-Language, Content-Language, Content-Type, anti-csrf, authorization, fdi-version, rid, st-auth-mode but the request came in with: access-control-allow-origin,content-type,rid,st-auth-mode and the browser blows up with CORS error. If I use a wild card in fastapi: allow_headers="*", then everything works fine I'm not super familiar with how this works, can somebody shed some light why this does not work without a wildcard?

hey @Raf this does not seem like a bug in the sdk, rather an issue with your cors cnfig on the backend - what's the exact cors error on the browser?

400 Bad request

That seems to be a cors related issue the You might wanna see the docs of the cors lib being used.

CORS config on the backend is 100% as in the recipe in the docs:

app = FastAPI()
app.add_middleware(get_middleware())

app.add_middleware(
    CORSMiddleware,
    allow_origins=[
        "http://localhost:4173",
        "http://localhost:5173",
        "http://0.0.0.0:5173",
        "http://192.168.0.17:5173"
    ],
    allow_credentials=True,
    allow_methods=["GET", "PUT", "POST", "DELETE", "OPTIONS", "PATCH"],
    allow_headers=["Content-Type"] + get_all_cors_headers(),  
)

So it’s get_all_cors_headers that’s causing it to fail?

looks like it

Right. I’m not sure why this could be happening. Have you tried our demo app using the CLI? That works as expected. Maybe see the differences between that and your app

I found the culprit. There was a leftover code from trying some of the lib: axios.defaults.headers['Content-type'] = 'application/json'; axios.defaults.headers.post['Access-Control-Allow-Origin'] = '*';

Right! That’s great

Sorry for waisting your time