[bug]: api requests from a browser fail due to api key header not being allowed

[Quadrubo]

Is there an existing issue for this?

• I have searched the existing issues

Current behavior

API requests that are being sent by a browser, for example by API testing tools like Yaade/Hoppscotch/Insomnia, fail because the header "X-API-Key" is not allowed by the plane server even though it is needed for authentication.

Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://plane.domain.com/api/v1/workspaces/general/projects/{project-id}/issues/. (Reason: header ‘x-api-key’ is not allowed according to header ‘Access-Control-Allow-Headers’ from CORS preflight response)

Steps to reproduce

1. Go to a browser based API testing tool like https://hoppscotch.io/.
2. Create a collection with a request to any plane api endpoint.
3. Create the header "X-API-Token" with a token you created from your workspace.
4. Send the request.

Environment

Production

Browser

Mozilla Firefox

Variant

Self-hosted

Version

stable (v0.21-dev)

[pablohashescobar]

@Quadrubo, thanks for pointing out this issue. We will merge the associated PR soon.

[Quadrubo]

@Quadrubo, thanks for pointing out this issue. We will merge the associated PR soon.

Thank you.
Would be nice to see this in the next release :)