From 4579b05d2c0922dabc0859667abd2982d4c7209a Mon Sep 17 00:00:00 2001
From: lobo <andreas.dahm@gmail.com>
Date: Thu, 24 Sep 2026 10:29:57 +0200
Subject: [PATCH] fix(cors): expose Retry-After so the login page can show the
 block time

---
 .../auth_service/configuration/security/SecurityConfig.java     | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/main/java/auth_service/configuration/security/SecurityConfig.java b/src/main/java/auth_service/configuration/security/SecurityConfig.java
index b7f92df..120c75e 100644
--- a/src/main/java/auth_service/configuration/security/SecurityConfig.java
+++ b/src/main/java/auth_service/configuration/security/SecurityConfig.java
@@ -68,6 +68,8 @@ public class SecurityConfig {
         configuration.setAllowedOriginPatterns(Arrays.asList(allowedOrigins));
         configuration.setAllowedMethods(List.of("GET", "POST", "PUT", "DELETE", "OPTIONS"));
         configuration.setAllowedHeaders(List.of("*"));
+        // Lets the login page read how long a rate-limit block lasts
+        configuration.setExposedHeaders(List.of("Retry-After"));
         configuration.setAllowCredentials(false); // Set to true later if we use cookies
 
         UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();