From 1a1d7f578a6a9cad24af667ad0eb6380d04affab Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20Garc=C3=ADa?=
 <dani-garcia@users.noreply.github.com>
Date: Mon, 9 Mar 2026 19:14:28 +0100
Subject: [PATCH] Support new desktop origin on CORS (#6920)

---
 src/util.rs | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/util.rs b/src/util.rs
index aa4e7914..6da1c3df 100644
--- a/src/util.rs
+++ b/src/util.rs
@@ -153,9 +153,11 @@ impl Cors {
     fn get_allowed_origin(headers: &HeaderMap<'_>) -> Option<String> {
         let origin = Cors::get_header(headers, "Origin");
         let safari_extension_origin = "file://";
+        let desktop_custom_file_origin = "bw-desktop-file://bundle";
 
         if origin == CONFIG.domain_origin()
             || origin == safari_extension_origin
+            || origin == desktop_custom_file_origin
             || (CONFIG.sso_enabled() && origin == CONFIG.sso_authority())
         {
             Some(origin)