# NousResearch/hermes-agent · CORS preflight blocked by auth middleware ordering

## Open now

- Nothing open on GitHub.

These issues and PRs address a middleware ordering problem where OPTIONS preflight requests hit the authentication gate before CORS handling, resulting in 401 responses. Proposed fixes involve registering CORSMiddleware outermost so preflight requests bypass the auth check.

## TL;DR

- 6 member(s): 0 open issue(s), 1 closed issue(s), 0 open PR(s), 1 merged PR(s), 4 PR(s) closed without merging.
- A fix was merged to main in PR #133870. Verify it addresses your case.
- **Recommended:** read PR #133870 (and any competing PRs below) before filing. Confirm the merged change covers your symptom.

## Maintainer resolution verdict

- Internal-tracker verdict over this cluster's issue members: `resolved` · deciding PR(s): `pr-133870`. This is distinct from the fix status above. Weigh it yourself.

## How this cluster was grouped

- Link evidence (`STRUCTURAL_SPANNING`): every member is connected by structural evidence: shared changed files, or a closing/superseded reference.
- Pairwise link density `0.33`: the share of member pairs that carry a link, counting a structural link in full and a relevance-only link at 0.36. `1.00` means every pair is linked.

## Closed / duplicate issues

- #59052: OPTIONS preflight returns 401 on /api/* — dashboard auth middleware ordered before CORS

## Prior & competing PRs

- **#133870: fix(dashboard): move CORSMiddleware outermost so OPTIONS preflights bypass auth**. merged to main · fix tier `verified`
  - maintainer direction: category `merged`; implication `superseded`
  - files: `hermes_cli/web_server.py`, `tests/hermes_cli/test_web_server_cors_preflight.py`
- **#59072: fix(dashboard): move CORSMiddleware outermost so OPTIONS preflight bypasses auth**. closed without merge
  - maintainer direction: category `superseded_by_pr`; implication `superseded`
- **#59111: fix: register CORSMiddleware outermost so OPTIONS preflight bypasses auth gate (#59052)**. closed without merge
  - maintainer direction: category `duplicate_of`; implication `duplicate`; refs `#59072`, `#59052`, `#59072`
- **#59189: fix(dashboard): short-circuit OPTIONS preflight in auth middleware for CORS**. closed without merge
  - maintainer direction: category `superseded_by_pr`; implication `superseded`
- **#59422: fix(dashboard): let CORS preflights bypass token gate**. closed without merge
  - maintainer direction: category `superseded_by_pr`; implication `superseded`

## Fix status

- Merged to main in PR #133870 (cited above). No release data is tracked. Verify downstream.
- Fix last verified (merged) `2026-10-06`.
- Subsystem: `dashboard`