From 94f8f449bdce9ee66424a282ced51e2cfaddca93 Mon Sep 17 00:00:00 2001 From: Adam Soltys Date: Sat, 1 Aug 2026 22:42:15 -0700 Subject: The real cause: the CORS preflight rejected our own auth header MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit NIP-98 puts the claim under an Authorization header, but the registrar only allowed content-type in access-control-allow-headers, so browsers blocked every claim before sending it. The failure arrived as a generic network error, which the retry logic treated as transient — hence the endless 'setting up your payment address' spinner. Bun tests never saw it because they don't preflight. Registrar now allows the header. Client-side, nothing may hang: signing, the registrar call and the ark lookup all have timeouts, retries are capped, and a one-minute watchdog always resolves the spinner into either an address or the manual form. Co-Authored-By: Claude Fable 5 --- names/server.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'names/server.js') diff --git a/names/server.js b/names/server.js index bd693b2..8f1971a 100644 --- a/names/server.js +++ b/names/server.js @@ -247,7 +247,7 @@ const json = (body, status = 200) => new Response(JSON.stringify(body), { headers: { 'content-type': 'application/json', 'access-control-allow-origin': '*', - 'access-control-allow-headers': 'content-type', + 'access-control-allow-headers': 'content-type,authorization', 'access-control-allow-methods': 'GET,POST,DELETE,OPTIONS', }, }); -- cgit v1.2.3