Merge branch 'dev'

api/src/main/java/fr/gameovergne/api/config/SecurityConfig.java

@@ -61,17 +61,26 @@ public class SecurityConfig {
     @Bean
     public CorsConfigurationSource corsConfigurationSource() {
         CorsConfiguration config = new CorsConfiguration();
-        config.setAllowedOriginPatterns(Arrays.asList(
+
-            "http://localhost:4200", 
+        // IMPORTANT : origins explicites, sans path
-            "http://127.0.0.1:4200", 
+        config.setAllowedOrigins(Arrays.asList(
-            "https://dev.vincent-guillet.fr",
+                "http://localhost:4200",
-            "https://projets.vincent-guillet.fr"
+                "http://127.0.0.1:4200",
-            ));
+                "https://dev.vincent-guillet.fr",
-        config.setAllowedMethods(Arrays.asList("GET","POST","PUT","DELETE","OPTIONS"));
+                "https://projets.vincent-guillet.fr"
-        config.setAllowedHeaders(Arrays.asList("Authorization","Content-Type","Accept"));
+        ));
-        config.setExposedHeaders(Arrays.asList("Authorization"));
+
         config.setAllowCredentials(true);
 
+        // Autoriser tous les headers côté requête (plus robuste)
+        config.setAllowedHeaders(Arrays.asList("*"));
+
+        // Autoriser les méthodes classiques
+        config.setAllowedMethods(Arrays.asList("GET", "POST", "PUT", "DELETE", "OPTIONS"));
+
+        // Headers que le client *voit* dans la réponse
+        config.setExposedHeaders(Arrays.asList("Authorization", "Content-Type"));
+
         UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
         source.registerCorsConfiguration("/**", config);
         return source;