Skip to main content

MTE Relay Server v4.8 Release Notes

· 2 min read
Trevor Blackman
Trevor Blackman
Engineering Director

v4.8.0 adds configurable CORS request header allowances so browser clients can send application headers unencrypted. Applies to MRS and MAR. Fully backwards compatible, no client changes required.

New​

  • CORS_ALLOWED_HEADERS (single upstream) and cors_allowed_headers (per DOMAIN_MAP entry) extend the header names the relay advertises in Access-Control-Allow-Headers during CORS preflight. The relay defaults content-type, x-mte-relay, and x-mte-relay-eh are always included and can never be removed.
  • Names are trimmed, lowercased, and deduplicated. Invalid HTTP field names and the standalone wildcard * fail startup with a config error. CORS_ALLOWED_HEADERS is rejected when DOMAIN_MAP is in use; each domain owns its own list.
  • Deployment templates (AWS ECS and EKS CloudFormation, Azure Container Apps, Azure Container Instances, and the AKS marketplace extension) expose the new setting.

Why​

With the browser SDK option encodeHeaders: false, application headers such as authorization stay visible and the browser asks for them by name in the preflight. Earlier v4 servers answered with a fixed allowance of three names, so the browser blocked the request before sending it. Encrypted headers were never affected because they travel inside x-mte-relay-eh.

Changed​

  • CORS responses now carry Vary: Origin alongside the echoed Access-Control-Allow-Origin, so shared caches never serve one origin's response to another.
  • Access-Control-Expose-Headers is unchanged and stays at the relay defaults. The new settings only grant permission to send request headers.

Upgrading​

  • Redeploy with image tag 4.8.0. No client updates needed.
  • Deployments that keep header encryption on need no configuration change.
  • To leave application headers visible, set CORS_ALLOWED_HEADERS=authorization,user-email (single upstream) or add "cors_allowed_headers": ["authorization", "user-email"] to the DOMAIN_MAP entry, then confirm the preflight response with curl -i -X OPTIONS and the real browser request.
  • Docs: CORS Request Headers and Version Compatibility.