From 415602d89ee28b77c3e1ddd65a9f5a163355aa43 Mon Sep 17 00:00:00 2001
From: Julian Lam <julian@nodebb.org>
Date: Fri, 27 Feb 2026 13:27:38 -0500
Subject: [PATCH] fix: #14003, set ACAO header on webfinger responses

---
 src/controllers/well-known.js | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/controllers/well-known.js b/src/controllers/well-known.js
index 0a9937f036..db2b663a0e 100644
--- a/src/controllers/well-known.js
+++ b/src/controllers/well-known.js
@@ -38,6 +38,7 @@ Controller.webfinger = async (req, res) => {
 			return res.sendStatus(404);
 		}
 
+		res.set('Access-Control-Allow-Origin', '*');
 		res.status(200).json(response);
 	} catch (e) {
 		res.sendStatus(404);