[Bug] api.z.ai Edge Omits CORS Headers on OPTIONS Preflight, Breaking All In-Browser Clients

Problem Description

Since ~2026-09-07, preflight HTTP OPTIONS requests sent to api.z.ai return HTTP/2 200 OK but completely omit all Access-Control-* response headers. As a result, standard in-browser fetch() / XMLHttpRequest calls fail with TypeError: Failed to fetch during CORS preflight validation.

Community Report Reference

• Reporter: davemanster (OP)
• Discord Thread: https://discord.com/channels/1346756824233148527/1547224836160364544
• Report Timestamp: 2026-09-09 15:39 SGT / 12:39 UTC

---

Verification & Live Reproduction

Executing an OPTIONS preflight request against the international gateway:

curl -i -X OPTIONS "https://api.z.ai/api/coding/paas/v4/chat/completions" \
  -H "Origin: https://example.com" \
  -H "Access-Control-Request-Method: POST" \
  -H "Access-Control-Request-Headers: authorization,content-type"

Observed Response (api.z.ai):

HTTP/2 200 
date: Wed, 09 Sep 2026 12:57:09 GMT
content-type: text/plain; charset=utf-8
alt-svc: h3=":443"; ma=3600
set-cookie: acw_tc=...
ga-traceid: 921950576098d28ee38fbbb68587a544
x-request-id: a901c3a6-3149-4a36-b70a-a4fdbe03fc80
vary: Origin

(Notice: Completely missing access-control-allow-origin, access-control-allow-methods, and access-control-allow-headers).

---

Comparative Evidence (open.bigmodel.cn Working Correctly)

Probing the CN edge with the identical request:

curl -i -X OPTIONS "https://open.bigmodel.cn/api/paas/v4/chat/completions" \
  -H "Origin: https://example.com" \
  -H "Access-Control-Request-Method: POST" \
  -H "Access-Control-Request-Headers: authorization,content-type"

Observed Response (open.bigmodel.cn):

HTTP/2 200 
vary: Origin
vary: Access-Control-Request-Method
vary: Access-Control-Request-Headers
access-control-allow-origin: https://example.com
access-control-allow-methods: POST
access-control-allow-headers: authorization, content-type
access-control-allow-credentials: true
access-control-max-age: 3600

---

Key Observations & Impact

1. Direct POST Still Works: Direct server-side POST requests directly to api.z.ai succeed with HTTP 200 and correctly return Access-Control-Allow-Origin: <origin>.
2. OPTIONS Regressed: Because browsers send an OPTIONS preflight whenever custom headers like Authorization: Bearer ... or Content-Type: application/json are specified, the absence of CORS response headers on OPTIONS kills all direct browser-based clients, web extensions, and web-based IDE plugins.
3. Scope: Affects /api/coding/paas/v4, /api/paas/v4, /v1, /api/anthropic/v1 on the api.z.ai domain.

Recommended Fix

Restore the ingress / reverse-proxy CORS injection policy on the api.z.ai edge controller so that OPTIONS preflights mirror the configuration of open.bigmodel.cn (returning Access-Control-Allow-Origin, Access-Control-Allow-Methods: POST, OPTIONS, and Access-Control-Allow-Headers: Authorization, Content-Type, ...).

---

Regards,
Roman M.

• Contributor / Ambassador at Z.ai
• Brain Backup: https://github.com/romangalaxys10-spec/Antigravity-Brain-Backup

No repository files or tests are identified; start by running the provided curl OPTIONS request against the affected api.z.ai endpoints and comparing it with open.bigmodel.cn. Done means the api.z.ai edge returns the required Access-Control-Allow-Origin, Access-Control-Allow-Methods, and Access-Control-Allow-Headers headers for browser preflights.