From e06f26b0952711ad08f91e4d44962577021d4f23 Mon Sep 17 00:00:00 2001
From: Henrique Dias <mail@hacdias.com>
Date: Sun, 15 Feb 2026 14:02:31 +0100
Subject: [PATCH] feat: update default CORS settings

---
 README.md     | 30 ++++++++++++++++++++++++------
 lib/config.go |  4 ++--
 2 files changed, 26 insertions(+), 8 deletions(-)

diff --git a/README.md b/README.md
index 20576c2..3dfd62a 100644
--- a/README.md
+++ b/README.md
@@ -128,18 +128,36 @@ log:
 # CORS configuration
 cors:
   # Whether or not CORS configuration should be applied. Default is 'false'.
-  # This is an example of how you can enable CORS.
   enabled: true
   credentials: true
-  allowed_headers:
-    - Depth
+  # The following are the default CORS settings when it is enabled.
   allowed_hosts:
     - *
+  allowed_headers:
+    - Authorization
+    - Content-Type
+    - Depth
+    - Destination
+    - If
+    - Lock-Token
+    - Overwrite
+    - TimeOut
+    - Translate
   allowed_methods:
+    - COPY
+    - DELETE
     - GET
-  exposed_headers:
-    - Content-Length
-    - Content-Range
+    - HEAD
+    - LOCK
+    - UNLOCK
+    - MKCOL
+    - MOVE
+    - OPTIONS
+    - POST
+    - PROPFIND
+    - PROPPATCH
+    - PUT
+  exposed_headers: []
 
 # You define here the list of users.
 # Basic authentication is automatically be configured when users are detected 
diff --git a/lib/config.go b/lib/config.go
index d3d7fe1..7526c7b 100644
--- a/lib/config.go
+++ b/lib/config.go
@@ -86,9 +86,9 @@ func ParseConfig(filename string, flags *pflag.FlagSet) (*Config, error) {
 	v.SetDefault("Log.Format", "console")
 	v.SetDefault("Log.Outputs", []string{"stderr"})
 	v.SetDefault("Log.Colors", true)
-	v.SetDefault("CORS.Allowed_Headers", []string{"*"})
 	v.SetDefault("CORS.Allowed_Hosts", []string{"*"})
-	v.SetDefault("CORS.Allowed_Methods", []string{"*"})
+	v.SetDefault("CORS.Allowed_Headers", []string{"Authorization", "Content-Type", "Depth", "Destination", "If", "Lock-Token", "Overwrite"})
+	v.SetDefault("CORS.Allowed_Methods", []string{"COPY", "DELETE", "GET", "HEAD", "LOCK", "MKCOL", "MOVE", "OPTIONS", "POST", "PROPFIND", "PROPPATCH", "PUT", "UNLOCK"})
 
 	// Read and unmarshal configuration
 	err := v.ReadInConfig()