CORS headers not present on API requests that 404 and maybe 5xx

[G-Rath]

Support was added in #3222 but looks to have gone again:

❯ curl -sSL -D - -o /dev/null -H 'Origin: localhost:3000' -d '{}'     "https://api.osv.dev/v1/query1"
HTTP/2 404
content-type: application/json
x-envoy-decorator-operation: ingress UnknownOperationName
x-cloud-trace-context: f1935a9e4c4ee53532c97f7297f20d17
date: Tue, 21 Apr 2026 21:51:56 GMT
server: Google Frontend
content-length: 73

[another-rex]

You need to include the Origin header for a CORS response. This I believe is sent by browsers when making cross site requests automatically when using fetch.

[G-Rath]

yup you're right, but it looks like CORS headers are not set for at least 404s and I would guess 5xxs too - not the end of the world, but I think it'd be nice to have so that clients can handle that more gracefully

[another-rex]

It should be added to 500s.

I think the issue with 404s is that the code handing the response (and the CORs policy) is only receiving requests on specific routes specified in osv_service_v1.proto e.g. https://api.osv.dev/v1/query and https://api.osv.dev/v1/querybatch. Everything else gets stopped earlier at the cloud endpoints level, not the cloud run level.

Probably more work than it's worth to get the CORs response at the endpoints level.

[anishesg]

Put together a fix in #5284.