Missing CORS headers for DELETE in API v2

What did you do?

• Setup Karma and AlertManager v0.24.0 over SSL on different domains
• Create a silence in Karma
• Try to delete it from Karma

What did you expect to see?

• A successful response from AlertManager
• The deletion of the desired silence

What did you see instead? Under which circumstances?

• No CORS headers in the responses to either the preflight request OPTIONS and the actual DELETE
• Network failure as the browser blocks the DELETE request, since the preflight request failed
• Silence not deleted

It seems like the CORS policy of API v1 allowed GET, POST, DELETE, OPTIONS, while API v2 uses rs/cors default configuration, which only allows GET, POST, HEAD.

Workaround
Add missing headers in Nginx

  location /api/v2 {
    proxy_pass http://alertmanager;
    if ($request_method = DELETE ) {
      add_header Access-Control-Allow-Methods "DELETE";
      add_header Access-Control-Allow-Origin "https://karma";
    }
    if ($http_access_control_request_method = DELETE ) {
      add_header Access-Control-Allow-Methods "DELETE";
      add_header Access-Control-Allow-Origin "https://karma";
    }
  }

Environment

• System information:

  Linux 5.4.0-48-generic x86_6

• Alertmanager version:

alertmanager, version 0.24.0 (branch: HEAD, revision: f484b17fa3c583ed1b2c8bbcec20ba1db2aa5f11)
  build user:       root@265f14f5c6fc
  build date:       20220325-09:31:33
  go version:       go1.17.8
  platform:         linux/amd64

• Prometheus version:

prometheus, version 2.29.2 (branch: HEAD, revision: 752c4f11ae86effa9a46f017f2feb66730c67ed8)
  build user:       root@61bcc9848ade
  build date:       20210827-09:44:22
  go version:       go1.16.7
  platform:         linux/amd64

Start in api/v2/api.go, where API v2 uses the rs/cors default configuration, and compare it with the API v1 CORS policy linked in the issue. Verify that preflight OPTIONS and actual DELETE responses include the required CORS headers, then test deletion through a browser client such as Karma.