From b6324894679baa96cb14dae4cae80de64232e36f Mon Sep 17 00:00:00 2001
From: LD-Reborn <lucretia.dietz@gmx.de>
Date: Sun, 19 Jul 2026 22:35:07 +0200
Subject: [PATCH] fix(server): fixes preflight CORS issue

---
 src/ReverseLlama.Server/Program.cs        | 4 ++--
 src/ReverseLlama.Server/ServerSettings.cs | 7 +++++++
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/src/ReverseLlama.Server/Program.cs b/src/ReverseLlama.Server/Program.cs
index febcb91..67317af 100644
--- a/src/ReverseLlama.Server/Program.cs
+++ b/src/ReverseLlama.Server/Program.cs
@@ -159,6 +159,8 @@ var managementStore = app.Services.GetRequiredService<ManagementStore>();
 var tunnelHub = app.Services.GetRequiredService<TunnelHub>();
 managementStore.SetConnectedClientProvider(() => tunnelHub.ClientSnapshots.Select(c => c.Id));
 
+app.UseCors();
+
 if (settings.Keycloak.IsConfigured)
 {
     app.UseAuthentication();
@@ -179,8 +181,6 @@ app.UseAntiforgery();
 
 app.UseElmah();
 
-app.UseCors();
-
 app.Use(async (context, next) =>
 {
     context.Response.Headers.XFrameOptions = "DENY";
diff --git a/src/ReverseLlama.Server/ServerSettings.cs b/src/ReverseLlama.Server/ServerSettings.cs
index 3925193..0d05e25 100644
--- a/src/ReverseLlama.Server/ServerSettings.cs
+++ b/src/ReverseLlama.Server/ServerSettings.cs
@@ -94,6 +94,13 @@ internal sealed class ServerSettings
 
     private static string[] ReadStringArray(IConfiguration configuration, params string[] keys)
     {
+        var section = configuration.GetSection(keys[0]);
+        var children = section.GetChildren().ToList();
+        if (children.Count > 0)
+        {
+            return children.Select(c => c.Value!).Where(v => !string.IsNullOrWhiteSpace(v)).ToArray();
+        }
+
         var value = Read(configuration, keys);
         if (string.IsNullOrWhiteSpace(value))
         {