fix: Add Authorization header to CORS allowed headers (sourcenetwork#…

…3178)

## Relevant issue(s)

Resolves sourcenetwork#3177 

## Description

This PR adds the Authorization header to the CORS list of allowed
headers. This bug what flagged from a partner trying to use
authorization from a browser app.

http/middleware.go

@@ -36,7 +36,7 @@ func CorsMiddleware(allowedOrigins []string) func(http.Handler) http.Handler {
 			return slices.Contains(allowedOrigins, strings.ToLower(origin))
 		},
 		AllowedMethods: []string{"GET", "HEAD", "POST", "PATCH", "DELETE"},
-		AllowedHeaders: []string{"Content-Type"},
+		AllowedHeaders: []string{"Content-Type", "Authorization"},
 		MaxAge:         300,
 	})
 }

http/server_test.go

@@ -183,6 +183,8 @@ func TestServerListenAndServeWithAllowedOrigins(t *testing.T) {
 	req, err := http.NewRequest(http.MethodOptions, "http://127.0.0.1:30001", nil)
 	require.NoError(t, err)
 	req.Header.Add("origin", "localhost")
+	req.Header.Add("Access-Control-Request-Method", "POST")
+	req.Header.Add("Access-Control-Request-Headers", "Authorization, Content-Type")
 
 	res, err := http.DefaultClient.Do(req)
 	require.NoError(t, err)