Preflight to /upload is blocked by Chrome v104+

[mabraidot]

Describe the problem

Starting with Chrome v104, requests to private networks will be blocked if they don't respond with the header:
Access-Control-Allow-Private-Network: true
Please, read about at developer.chrome.com

To reproduce

Update Chrome to the latest.
Make a POST request to http://localhost:{AGENT_PORT}/upload

Expected behavior

Response code: 200
Header: Access-Control-Allow-Private-Network: true

Arduino Create Agent version

1.2.6

Operating system

Windows

Operating system version

11

Browser

Chrome

Browser version

105.0.5195.125

Additional context

No response

Issue checklist

• I searched for previous reports in the issue tracker
• I verified the problem still occurs when using the latest version
• My report contains all necessary details

[umbynos]

Thanks a lot for this heads up!

Apparently from the rollout plan

In Chrome 107 at the earliest:
...

• Chrome enforces that preflight requests must succeed, otherwise failing the requests.

This means that as of now this should be still working, but starting from Chrome 107 it will break.

After some investigation, I've found that the library we use for the CORS does not support this. We could switch to the more popular and maintained gin-contrib/cors but it doesn't support preflight request yet.

[umbynos]

The timeline of chrome changed: https://developer.chrome.com/blog/private-network-access-update/#chrome-117
Chrome 117 is scheduled for september 2023

[jub0bs]

@umbynos FWIW, jub0bs/fcors supports Private Network Access and can be used in conjunction with Gin.

[jub0bs]

Incidentally, gin-contrib/cors also appears to support Private Network Access, now.