From ebdd41d965a42be42bf09e0b29377fb5aacb2de3 Mon Sep 17 00:00:00 2001
From: Bram Verhulst <Brammieverhulst@gmail.com>
Date: Sat, 22 Aug 2026 18:41:36 +0200
Subject: [PATCH] fix2

---
 backend/internal/storage/storage.go | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/backend/internal/storage/storage.go b/backend/internal/storage/storage.go
index 8118696..ab0c4a8 100644
--- a/backend/internal/storage/storage.go
+++ b/backend/internal/storage/storage.go
@@ -103,8 +103,15 @@ func (s *MinIO) EnsureBucket(ctx context.Context) error {
 	if err := s.client.SetBucketCors(ctx, s.bucket, cors.NewConfig([]cors.Rule{{
 		ID:            "studio-browser-uploads",
 		AllowedOrigin: origins,
-		AllowedMethod: []string{"GET", "PUT", "POST", "PATCH", "DELETE", "HEAD"},
-		AllowedHeader: []string{"*"},
+		AllowedMethod: []string{"GET", "PUT", "POST", "DELETE", "HEAD"},
+		AllowedHeader: []string{
+			"Content-Type",
+			"x-amz-acl",
+			"x-amz-date",
+			"x-amz-content-sha256",
+			"Authorization",
+			"Origin",
+		},
 		ExposeHeader:  []string{"ETag", "x-amz-request-id", "x-amz-id-2"},
 		MaxAgeSeconds: 3600,
 	}})); err != nil {