From bd4f4e820759dfdd1610e7fb3658bd08408b556a Mon Sep 17 00:00:00 2001 From: redshift <213178690+1ftredsh@users.noreply.github.com> Date: Mon, 29 Jun 2026 16:33:25 +0800 Subject: [PATCH] fix: expose Ehbp-Response-Nonce and Ehbp-Encapsulated-Key in CORS Browser clients need these EHBP protocol headers visible to JavaScript so the Tinfoil SDK can detect and decrypt encrypted responses. Without them, CORS hides the headers, the SDK treats the response as a plaintext proxy error, and users see 'The provider did not respond to this request.' Node.js scripts are unaffected (no CORS enforcement). See ../routstr-chat/TINFOIL_CORS_ISSUE.md for full root-cause analysis. --- routstr/core/main.py | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/routstr/core/main.py b/routstr/core/main.py index 3001e56b..c9598a1c 100644 --- a/routstr/core/main.py +++ b/routstr/core/main.py @@ -264,6 +264,12 @@ app.add_middleware( "x-routstr-cost-usd", "x-routstr-input-cost-msats", "x-routstr-output-cost-msats", + # EHBP (Tinfoil) protocol headers must be exposed so browser clients + # can detect and decrypt encrypted responses. Without these, the + # browser hides them via CORS and the SDK treats the response as a + # plaintext proxy error, returning raw ciphertext. + "Ehbp-Response-Nonce", + "Ehbp-Encapsulated-Key", ], )