{"repo":"NousResearch/hermes-agent","public_id":"59052","display_label":"CORS preflight blocked by auth middleware ordering","summary":"These issues and PRs address a middleware ordering problem where OPTIONS preflight requests hit the authentication gate before CORS handling, resulting in 401 responses. Proposed fixes involve registering CORSMiddleware outermost so preflight requests bypass the auth check.","subsystem":"dashboard","counts":{"members":6,"open_issues":0,"open_issues_distinct":0,"open_prs":0,"closed_issues":1,"merged_prs":1,"attempt_prs":4},"landed_fix":{"status":"merged_to_main","basis":"structural","pr":133870},"resolution":{"state":"resolved","by":"pr-133870"},"freshness":{"state":"verified","last_verified_at":"2026-10-06T15:15:22+00:00","is_stale":false},"grouping":{"backbone":"STRUCTURAL_SPANNING","link_density":0.3333333333333333},"fix_edges":[{"issue_number":59052,"pr_number":133870,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true}],"members":[{"kind":"issue","number":59052,"title":"OPTIONS preflight returns 401 on /api/* — dashboard auth middleware ordered before CORS","url":null,"state":"closed"},{"kind":"pr","number":59072,"title":"fix(dashboard): move CORSMiddleware outermost so OPTIONS preflight bypasses auth","url":null,"state":"closed","close_reason":{"category":"superseded_by_pr","implication":"superseded"},"merged":false},{"kind":"pr","number":59111,"title":"fix: register CORSMiddleware outermost so OPTIONS preflight bypasses auth gate (#59052)","url":null,"state":"closed","close_reason":{"refs":[{"kind":"pr","value":"#59072","number":59072},{"kind":"pr","value":"#59052","number":59052},{"kind":"pr","value":"#59072","number":59072}],"category":"duplicate_of","implication":"duplicate"},"merged":false},{"kind":"pr","number":59189,"title":"fix(dashboard): short-circuit OPTIONS preflight in auth middleware for CORS","url":null,"state":"closed","close_reason":{"category":"superseded_by_pr","implication":"superseded"},"merged":false},{"kind":"pr","number":59422,"title":"fix(dashboard): let CORS preflights bypass token gate","url":null,"state":"closed","close_reason":{"category":"superseded_by_pr","implication":"superseded"},"merged":false},{"kind":"pr","number":133870,"title":"fix(dashboard): move CORSMiddleware outermost so OPTIONS preflights bypass auth","url":null,"state":"merged","close_reason":{"category":"merged","implication":"superseded"},"merged":true,"is_fix_pr":true,"fix_tier":"verified","files_changed":["hermes_cli/web_server.py","tests/hermes_cli/test_web_server_cors_preflight.py"]}],"trust":{"default_tier":"verified","includes_suggested":false}}