fix: preflight requests

app/init/resources.php

@@ -198,8 +198,14 @@ App::setResource('allowedHostnames', function (array $platform, Document $projec
         $allowed[] = $request->getHostname();
     }
 
-    /* Allow the request origin if a dev key or rule is found */
     $originHostname = parse_url($request->getOrigin(), PHP_URL_HOST);
+
+    /* Add request hostname for preflight requests */
+    if ($request->getMethod() === 'OPTIONS') {
+        $allowed[] = $originHostname;
+    }
+
+    /* Allow the request origin if a dev key or rule is found */
     if ((!$rule->isEmpty() || !$devKey->isEmpty()) && !empty($originHostname)) {
         $allowed[] = $originHostname;
     }

tests/e2e/General/HTTPTest.php

@@ -184,7 +184,22 @@ class HTTPTest extends Scope
             'origin' => 'http://google.com',
         ]);
         $this->assertNull($response['headers']['access-control-allow-origin'] ?? null);
+    }
 
+    public function testPreflight()
+    {
+
+        $endpoint = '/v1/projects'; // Can be any non-404 route
+
+        /**
+         * Test for SUCCESS
+         */
+        $response = $this->client->call(Client::METHOD_OPTIONS, $endpoint, [
+            'origin' => 'http://random.com',
+            'access-control-request-headers' => 'X-Appwrite-Project',
+            'access-control-request-method' => 'GET'
+        ]);
+        $this->assertEquals('http://random.com', $response['headers']['access-control-allow-origin']);
     }
 
     public function testConsoleRedirect()