From 144ef0880a55ac8f623247c4a795730be95d92ee Mon Sep 17 00:00:00 2001
From: NeatGuyCoding <15627489+NeatGuyCoding@users.noreply.github.com>
Date: Tue, 27 Jan 2026 16:03:32 +0400
Subject: [PATCH] fix(cors): correct CORS resource pattern for /console/api
 routes (#31485)

Signed-off-by: NeatGuyCoding <15627489+NeatGuyCoding@users.noreply.github.com>
---
 api/extensions/ext_fastopenapi.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/api/extensions/ext_fastopenapi.py b/api/extensions/ext_fastopenapi.py
index 5f98aa7b67..e6c1bc6bee 100644
--- a/api/extensions/ext_fastopenapi.py
+++ b/api/extensions/ext_fastopenapi.py
@@ -36,7 +36,7 @@ def init_app(app: DifyApp) -> None:
     router.include_router(console_router, prefix="/console/api")
     CORS(
         app,
-        resources={r"/console/api/*": {"origins": dify_config.CONSOLE_CORS_ALLOW_ORIGINS}},
+        resources={r"/console/api/.*": {"origins": dify_config.CONSOLE_CORS_ALLOW_ORIGINS}},
         supports_credentials=True,
         allow_headers=list(AUTHENTICATED_HEADERS),
         methods=["GET", "PUT", "POST", "DELETE", "OPTIONS", "PATCH"],