From 5ef41da651dde2e0d40ac10fc5f6af1f02f3fb48 Mon Sep 17 00:00:00 2001
From: Stewart Allen <stewart.allen@gmail.com>
Date: Sun, 1 Mar 2026 22:58:17 -0500
Subject: [PATCH] add cors headers, explicit local host for proxy

---
 app.js                 | 2 +-
 mods/proxy/init.js     | 3 ++-
 src/kiri/app/export.js | 2 +-
 3 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/app.js b/app.js
index 57ea3add..a5f78d82 100644
--- a/app.js
+++ b/app.js
@@ -516,7 +516,7 @@ function ifModifiedDate(req) {
 
 function addCorsHeaders(req, res) {
     res.setHeader('Access-Control-Allow-Credentials', 'true');
-    res.setHeader('Access-Control-Allow-Headers', 'X-Moto-Ajax, Content-Type');
+    res.setHeader('Access-Control-Allow-Headers', 'X-Api-Key, X-Host, X-Moto-Ajax, Content-Type');
     res.setHeader('Access-Control-Allow-Origin', req.headers['origin'] || '*');
     if (req.headers['access-control-request-private-network'] === 'true') {
         res.setHeader('Access-Control-Allow-Private-Network', 'true');
diff --git a/mods/proxy/init.js b/mods/proxy/init.js
index 350462a5..8fd8cb31 100644
--- a/mods/proxy/init.js
+++ b/mods/proxy/init.js
@@ -1,6 +1,6 @@
 module.exports = async (server) => {
 
-    const { api, env, path, util } = server;
+    const { api, env, handler, path, util } = server;
 
     server.inject("kiri", "main.js");
 
@@ -17,6 +17,7 @@ module.exports = async (server) => {
 };
 
 function proxy_post(req, res, next) {
+    handler.addCORS(req, res);
     if (req.method === 'POST') {
         let { url, headers } = req;
         let chunks = [];
diff --git a/src/kiri/app/export.js b/src/kiri/app/export.js
index 96e5e18e..09897b24 100644
--- a/src/kiri/app/export.js
+++ b/src/kiri/app/export.js
@@ -266,7 +266,7 @@ function exportGCodeDialog(gcode, sections, info, names) {
 
         if (proxy) {
             console.log('proxying request to', host);
-            host = '';
+            host = 'http://127.0.0.1:5309';
         }
 
         filename = $('print-filename').value + "." + fileext;