Hugging Face Spaces proxy suddenly stripping Access-Control-Allow-Credentials header on OPTIONS preflight?

Hey everyone,

I’ve had a full-stack MERN app running perfectly for months. The backend is hosted on Hugging Face Spaces (express server in a Docker container), and the frontend is on Vercel.

Out of nowhere, my /user/login route started failing with a CORS error: The value of the 'Access-Control-Allow-Credentials' header in the response is '' which must be 'true' when the request's credentials mode is 'include'.

When inspecting the Network tab , I can see that the browser sends an OPTIONS preflight request, and the response headers from the backend look like this:

HTTP

access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: https://iskra-edu.vercel.app
access-control-max-age: 600
content-length: 0
vary: origin, access-control-request-method, access-control-request-headers

As you can see, Access-Control-Allow-Credentials is completely missing.

The catch: My Express code explicitly has credentials: true configured inside the cors middleware, and I even added a manual global wildcard middleware at the very top of my app to force-inject the header on all OPTIONS requests:

JavaScript

app.use((req, res, next) => {
    res.setHeader('Access-Control-Allow-Credentials', 'true');
    if (req.method === 'OPTIONS') return res.sendStatus(200);
    next();
});

Even with this, the header never reaches the browser. It seems like the Hugging Face edge proxy/routing mesh is intercepting the OPTIONS request and stripping out the Access-Control-Allow-Credentials header before it can hit my container, or it’s answering the preflight entirely on its own.

Has anyone else experienced Hugging Face randomly breaking preflight CORS headers recently? Is there a new configuration in README.md or the routing mesh that I missed? Any help or workaround (besides bypassing preflight via URL-encoded forms) would be highly appreciated!