fix(cors): update CORS headers handling for requests

* Reflect request origin for Access-Control-Allow-Origin
* Set Vary header for caching based on origin
* Allow specific headers from preflight requests
* Enable credentials only for specific origins

pkg/common/cors.go

@@ -115,32 +115,39 @@ func GetHeadSpecHeaders() []string {
 
 // SetCORSHeaders sets CORS headers on a response writer
 func SetCORSHeaders(w ResponseWriter, r Request, config CORSConfig) {
-	// Set allowed origins
+	// Reflect the request origin; fall back to wildcard only when no origin is present
-	// if len(config.AllowedOrigins) > 0 {
+	origin := r.Header("Origin")
-	// 	w.SetHeader("Access-Control-Allow-Origin", strings.Join(config.AllowedOrigins, ", "))
+	if origin == "" {
-	// }
+		origin = "*"
-
+	} else {
-	// Todo origin list parsing
+		// Vary must be set so caches don't serve one origin's response to another
-	w.SetHeader("Access-Control-Allow-Origin", "*")
+		httpW := w.UnderlyingResponseWriter()
+		httpW.Header().Set("Vary", "Origin")
+	}
+	w.SetHeader("Access-Control-Allow-Origin", origin)
 
 	// Set allowed methods
 	if len(config.AllowedMethods) > 0 {
 		w.SetHeader("Access-Control-Allow-Methods", strings.Join(config.AllowedMethods, ", "))
 	}
 
-	// Set allowed headers
+	// Reflect the preflight request headers when present; otherwise use the explicit config list
-	// if len(config.AllowedHeaders) > 0 {
+	requestedHeaders := r.Header("Access-Control-Request-Headers")
-	// 	w.SetHeader("Access-Control-Allow-Headers", strings.Join(config.AllowedHeaders, ", "))
+	if requestedHeaders != "" {
-	// }
+		w.SetHeader("Access-Control-Allow-Headers", requestedHeaders)
-	w.SetHeader("Access-Control-Allow-Headers", "*")
+	} else if len(config.AllowedHeaders) > 0 {
+		w.SetHeader("Access-Control-Allow-Headers", strings.Join(config.AllowedHeaders, ", "))
+	}
 
 	// Set max age
 	if config.MaxAge > 0 {
 		w.SetHeader("Access-Control-Max-Age", fmt.Sprintf("%d", config.MaxAge))
 	}
 
-	// Allow credentials
+	// Allow credentials only when a specific origin is reflected (not wildcard)
+	if origin != "*" {
 		w.SetHeader("Access-Control-Allow-Credentials", "true")
+	}
 
 	// Expose headers that clients can read
 	exposeHeaders := config.AllowedHeaders

pkg/server/interfaces.go

@@ -42,6 +42,10 @@ type Config struct {
 	// AutoTLSEmail is the email for Let's Encrypt registration (optional but recommended)
 	AutoTLSEmail string
 
+	// PanicHandler is called when a request handler panics.
+	// If nil, the default middleware.PanicRecovery is used (logs, records metric, returns 500).
+	PanicHandler func(w http.ResponseWriter, r *http.Request, rcv any)
+
 	// Graceful shutdown configuration
 	// ShutdownTimeout is the maximum time to wait for graceful shutdown
 	// Default: 30 seconds

pkg/server/manager.go

@@ -452,8 +452,19 @@ func newInstance(cfg Config) (*serverInstance, error) {
 		handler = gz(handler)
 	}
 
-	// Wrap with the panic recovery middleware
+	// Wrap with panic recovery — use caller-supplied handler if provided
+	if cfg.PanicHandler != nil {
+		handler = http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			defer func() {
+				if rcv := recover(); rcv != nil {
+					cfg.PanicHandler(w, r, rcv)
+				}
+			}()
+			handler.ServeHTTP(w, r)
+		})
+	} else {
 		handler = middleware.PanicRecovery(handler)
+	}
 
 	// Configure TLS if any TLS option is enabled
 	tlsConfig, certFile, keyFile, err := configureTLS(cfg)
@@ -475,6 +486,10 @@ func newInstance(cfg Config) (*serverInstance, error) {
 	// The GODEBUG=http2xconnect=1 flag is read by net/http's init(); setting it here
 	// ensures it propagates to subprocesses and any future process restarts.
 	// For the current process, set GODEBUG=http2xconnect=1 in the environment before launch.
+	if httpServer.Protocols == nil {
+		httpServer.Protocols = &http.Protocols{}
+		httpServer.Protocols.SetHTTP1(true)
+	}
 	if cfg.HTTP2 {
 		if existing := os.Getenv("GODEBUG"); !strings.Contains(existing, "http2xconnect=1") {
 			if existing == "" {
@@ -489,6 +504,7 @@ func newInstance(cfg Config) (*serverInstance, error) {
 		httpServer.Protocols.SetHTTP2(true)
 		httpServer.Protocols.SetUnencryptedHTTP2(true)
 	} else {
+		httpServer.Protocols.SetHTTP1(true)
 		httpServer.Protocols.SetHTTP2(false)
 	}