[openstreetmap/openstreetmap-website] CORS issues in Firefox with API (Issue #5983)

[wolfy1339]

wolfy1339 created an issue (openstreetmap/openstreetmap-website#5983)

### URL

https://www.openstreetmap.org/edit

### How to reproduce the issue?

Firefox 138.0 Fedora 42 
1. Open iD at any location
3. iD doesn't load any data
4. Open the Network tab in the developper tools
5. Observe many failed requests due to CORS

### Screenshot(s) or anything else?

While this bug happens with iD, it is not a bug within iD as it is an error with the headers returned from the API.

The API is returning the following header:
```
access-control-allow-headers: Content-Type
````
while the request is
```
Access-Control-Request-Headers: authorization
```

The solution is to add the `authorization` header to `access-control-allow-headers`

-- 
Reply to this email directly or view it on GitHub:
https://github.com/openstreetmap/openstreetmap-website/issues/5983
You are receiving this because you are subscribed to this thread.

Message ID: <openstreetmap/openstreetmap-website/issues/5983 at github.com>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openstreetmap.org/pipermail/rails-dev/attachments/20250505/d26a6d8d/attachment.htm>