fix: removed duplicate CORS middleware

server/bootstrap.py

@@ -1,7 +1,6 @@
 """Application bootstrap helpers for the FastAPI server."""
 
 from fastapi import FastAPI
-from fastapi.middleware.cors import CORSMiddleware
 
 from server import state
 from server.config_schema_router import router as config_schema_router
@@ -13,14 +12,6 @@ from utils.middleware import add_middleware
 def init_app(app: FastAPI) -> None:
     """Apply shared middleware, routers, and global state to ``app``."""
 
-    app.add_middleware(
-        CORSMiddleware,
-        allow_origins=["*"],
-        allow_credentials=True,
-        allow_methods=["*"],
-        allow_headers=["*"],
-    )
-
     add_exception_handlers(app)
     add_middleware(app)
 

utils/middleware.py

@@ -87,9 +87,9 @@ async def rate_limit_middleware(request: Request, call_next: Callable):
     return response
 
 
-def add_middleware(app: FastAPI):
-    """Add all middleware to the FastAPI application."""
-    # CORS (dev defaults; override via CORS_ALLOW_ORIGINS comma-separated list)
+def add_cors_middleware(app: FastAPI) -> None:
+    """Configure and attach CORS middleware."""
+    # Dev defaults; override via CORS_ALLOW_ORIGINS (comma-separated)
     default_origins = [
         "http://localhost:5173",
         "http://127.0.0.1:5173",
@@ -103,7 +103,6 @@ def add_middleware(app: FastAPI):
         # Helpful in dev: allow localhost/127.0.0.1 on any port
         origin_regex = r"^https?://(localhost|127\.0\.0\.1)(:\d+)?$"
 
-    # Add CORS middleware first to handle preflight requests and allow origins.
     app.add_middleware(
         CORSMiddleware,
         allow_origins=origins,
@@ -115,9 +114,15 @@ def add_middleware(app: FastAPI):
         max_age=600,
     )
 
+
+def add_middleware(app: FastAPI):
+    """Add all middleware to the FastAPI application."""
+    # Attach CORS first to handle preflight requests and allow origins.
+    add_cors_middleware(app)
+
     # Add other middleware
     app.middleware("http")(correlation_id_middleware)
     app.middleware("http")(security_middleware)
     # app.middleware("http")(rate_limit_middleware)  # Enable if needed
     
-    return app
+    return app