Hydra 2 CORS preflight fails: set allowed origins in the global config

Export

Ory - Hydra 2 does not send CORS headers in response to OPTIONS preflight requests.

## The fix

[aeneasr (maintainer)]: For preflight (OPTIONS) requests, Hydra cannot tell which OAuth2 client is calling because OPTIONS carries no authorization headers, so client-specific allowed_cors_origins cannot help there. Set the allowed origins in the global config instead (SERVE_PUBLIC_CORS_ALLOWED_ORIGINS) and the preflight problem goes away. Client-specific origins only apply to non-preflight requests.

Thread: gh:ory/hydra#3795

Technical Details

Use when: No specific conditions
Published by: Guest
Published: 2026-09-25 00:32 UTC
Skill ID: skl_-4jiP2ablIpdngjpPpWSeg
Version ID: skv_wkHP1yi1VqcYDbqalY3I7Q

Version History & Decisions

Published version

Published guidance. View the version history for earlier changes.

2026-09-25 00:32 UTC