fix: expose WWW-Authenticate header for cross-origin clients.

2026-07-21 11:07:30 -04:00 · 2026-07-21 11:07:30 -04:00 · 1167ac795d
parent 895d314b86
commit 1167ac795d
1 changed files with 1 additions and 0 deletions
--- a/mcp/src/index.ts
+++ b/mcp/src/index.ts
@ -11,6 +11,7 @@ const CORS_HEADERS = {
  "Access-Control-Allow-Origin": CORS_ORIGIN,
  "Access-Control-Allow-Methods": CORS_METHODS,
  "Access-Control-Allow-Headers": CORS_ALLOWED_HEADERS,
+  "Access-Control-Expose-Headers": "WWW-Authenticate",
 };

 const PROTECTED_RESOURCE_PATH = "/.well-known/oauth-protected-resource";