From v7.6.0: Client request via REST API - CORS Missing Allow Origin responds

[web-uni-jena]

Description:

When I try to retrieve the configuration for the live chat via the REST API, I get an incomplete header for the CORS headers in response. This leads to a CORS error in the browser on the client side if you request the endpoint via JS, for example.

The response header Access-Control-Allow-Origin: * is missing although the settings Enable CORS and CORS Origin=* are enabled in the configuration /admin/settings/General -> REST API

Steps to reproduce:

1. Enable CORS and CORS Origin=* are enabled in the configuration /admin/settings/General
2. Make a request via cURL to the configuration https://developer.rocket.chat/apidocs/get-livechat-configurations

Expected behavior:

Required response header for CORS

Access-Control-Allow-Origin: *
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, X-User-Id, X-Auth-Token, x-visitor-token, Authorization
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, HEAD, PATCH

Actual behavior:

one response header for CORS is missing

Access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, X-User-Id, X-Auth-Token, x-visitor-token, Authorization
Access-control-allow-methods: GET, POST, PUT, DELETE, HEAD, PATCH

Server Setup Information:

• Version of Rocket.Chat Server: Version v7.6.0
• License Type:
• Number of Users:
• Operating System:
• Deployment Method: docker
• Number of Running Instances: 1
• DB Replicaset Oplog:
• NodeJS Version: v22.13.1
• MongoDB Version: 8.0.6

Client Setup Information

• Desktop App or Browser Version: via CURL or JS appl.
• Operating System: Linux/Win

Additional context

Relevant logs:

[MelkorCC]

I can confirm that the problem also exists for me, my guess is this regression was introduced somewhere in #35078