Merge pull request #12957 from backstage/cors-allow-patch-method

Add PATCH and HEAD to the Access-Control-Allow-Methods

.changeset/wicked-knives-wink.md

@@ -0,0 +1,14 @@
+---
+'@backstage/create-app': patch
+---
+
+Add `PATCH` and `HEAD` to the `Access-Control-Allow-Methods`.
+
+To apply this change to your Backstage installation make the following change to your `app-config.yaml`
+
+```diff
+   cors:
+     origin: http://localhost:3000
+-    methods: [GET, POST, PUT, DELETE]
++    methods: [GET, POST, PUT, DELETE, PATCH, HEAD]
+```

app-config.yaml

@@ -39,7 +39,7 @@ backend:
     store: memory
   cors:
     origin: http://localhost:3000
-    methods: [GET, POST, PUT, DELETE]
+    methods: [GET, HEAD, PATCH, POST, PUT, DELETE]
     credentials: true
   csp:
     connect-src: ["'self'", 'http:', 'https:']

packages/create-app/templates/default-app/app-config.yaml.hbs

@@ -24,7 +24,7 @@ backend:
     # Default Helmet Content-Security-Policy values can be removed by setting the key to false
   cors:
     origin: http://localhost:3000
-    methods: [GET, POST, PUT, DELETE]
+    methods: [GET, HEAD, PATCH, POST, PUT, DELETE]
     credentials: true
   # This is for local developement only, it is not recommended to use this in production
   # The production database configuration is stored in app-config.production.yaml