dm / commit

fix: use correct CORS header for direct browser API access

bc65c65adbba006a1d0d622dce44b50218f80af1 · Pavel Safronov · 2026-05-27 15:48:41 -0700 · parents 66a0abe97afc

fix: use correct CORS header for direct browser API access

Anthropic's API rejects preflight requests using the old header name
`anthropic-dangerous-allow-browser` with HTTP 400 "Disallowed CORS origin".
The correct header is `anthropic-dangerous-direct-browser-access`.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

 public/index.html | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/public/index.html b/public/index.html
index 96dbc63..006bd46 100644
--- a/public/index.html
+++ b/public/index.html
@@ -1683,12 +1683,12 @@ async function sendMessage(text, showAsPlayer = true) {
             'Content-Type': 'application/json',
             'x-api-key': gameState.apiKey,
             'anthropic-version': '2023-06-01',
-            'anthropic-dangerous-allow-browser': 'true',
+            'anthropic-dangerous-direct-browser-access': 'true',
           },
           body: JSON.stringify(requestBody),
         });
       } catch (fetchErr) {
-        // fetch() itself threw — almost always a CORS preflight failure or network issue
+        // fetch() itself threw — CORS preflight rejected or network down
         console.error('🔴 fetch() threw (CORS / network):', fetchErr);
         throw new Error(
           `Network error — could not reach Anthropic. Likely causes:\n` +