From da8afc696d453832e6252a44b9d192d04fa1308f Mon Sep 17 00:00:00 2001
From: Rory& <root@rory.gay>
Date: Mon, 19 Oct 2026 13:16:29 +0200
Subject: [PATCH] fix middleware orderingon cdn

---
 src/api/middlewares/CORS.ts | 6 ++----
 src/cdn/Server.ts           | 4 ++--
 2 files changed, 4 insertions(+), 6 deletions(-)

diff --git a/src/api/middlewares/CORS.ts b/src/api/middlewares/CORS.ts
index 1dcce0d69..6cb2b1d8c 100644
--- a/src/api/middlewares/CORS.ts
+++ b/src/api/middlewares/CORS.ts
@@ -32,9 +32,7 @@ export function CORS(req: Request, res: Response, next: NextFunction) {
         "default-src *  data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: ; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';",
     );
 
-    if (req.method === "OPTIONS") {
-        res.status(204).send();
-        return;
-    }
+    if (req.method === "OPTIONS") return res.sendStatus(204);
+
     next();
 }
diff --git a/src/cdn/Server.ts b/src/cdn/Server.ts
index 77016ddf3..b585fc7c4 100644
--- a/src/cdn/Server.ts
+++ b/src/cdn/Server.ts
@@ -67,10 +67,10 @@ export class CDNServer extends Server {
 
         this.app.disable("x-powered-by");
 
-        this.app.use(Authentication);
-        this.app.use(ErrorHandler);
         this.app.use(CORS);
+        this.app.use(Authentication);
         this.app.use(BodyParser({ inflate: true, limit: "10mb" }));
+        this.app.use(ErrorHandler);
 
         await registerRoutes(this, path.join(__dirname, "routes/"));