Merge pull request #151 from InstaNode-dev/fix/login-callback-no-accept-header

fix(login): drop Accept header — /auth/exchange POST blocked by CORS preflight (P0 follow-up)

Author: mastermanas805

src/pages/LoginCallbackPage.test.tsx

@@ -107,6 +107,13 @@ describe('LoginCallbackPage', () => {
     expect(init.method).toBe('POST')
     expect(init.credentials).toBe('include')
     expect(api.setToken).toHaveBeenCalledWith('xyz')
+    // Regression guard: NO custom request headers. A POST with only
+    // safelisted headers + credentials:include is a "simple cross-origin
+    // request" and avoids a CORS preflight. Adding Accept or Content-Type
+    // would force an OPTIONS preflight that the api's PreflightAllowlist
+    // rejects (those headers aren't in corsAllowHeaders), surfacing as
+    // "Failed to fetch" in the browser.
+    expect(init.headers).toBeUndefined()
   })
 
   it('AUTH-004: exchange non-2xx surfaces the api error message', async () => {

src/pages/LoginCallbackPage.tsx

@@ -16,10 +16,16 @@ import { setToken, fetchMe, getAPIBaseURL } from '../api'
 // api/internal/handlers/auth.go appendSessionToken docstring).
 async function exchangeCookieForToken(): Promise<string> {
   const apiBase = getAPIBaseURL()
+  // DELIBERATE: no custom headers (no Accept, no Content-Type). A POST
+  // with only safelisted headers + credentials:include is a "simple
+  // cross-origin request" per the CORS spec — no preflight. Adding
+  // Accept:application/json would force an OPTIONS preflight that the
+  // api's PreflightAllowlist rejects (Accept not in corsAllowHeaders),
+  // returning 403 → "Failed to fetch" in the browser. The api returns
+  // JSON regardless of the request Accept header.
   const resp = await fetch(`${apiBase}/auth/exchange`, {
     method: 'POST',
     credentials: 'include',
-    headers: { Accept: 'application/json' },
   })
   if (!resp.ok) {
     let detail = ''