api.spotify.com CORS preflight broken

[thuvarT]

Browser apps calling the Spotify Web API are failing with CORS errors on authenticated requests (e.g. GET https://api.spotify.com/v1/me).

The OAuth login popup can still open/complete, but the follow-up browser fetch to api.spotify.com fails because the CORS preflight is broken.

Reproduction:

1) Broken — browser-style preflight WITH Origin
curl -i -X OPTIONS "https://api.spotify.com/v1/me" \
-H "Origin: https://example.com" \
-H "Access-Control-Request-Method: GET" \
-H "Access-Control-Request-Headers: authorization"

Actual response:
HTTP/1.1 200 OK
Content-Length: 0
(no Access-Control-Allow-Origin / Allow-Methods / Allow-Headers)

This also fails the same way with:
- Origin: https://dashboard-staging.lyricfind.com
- Origin: http://localhost:3000

So it does not appear to be app/domain specific.

2) Control — OPTIONS WITHOUT Origin
curl -i -X OPTIONS "https://api.spotify.com/v1/me" \
-H "Access-Control-Request-Method: GET" \
-H "Access-Control-Request-Headers: authorization"

Response:
HTTP/1.1 204 No Content
allow: GET, HEAD, OPTIONS

3) Control — accounts.spotify.com token OPTIONS still works
curl -i -X OPTIONS "https://accounts.spotify.com/api/token" \
-H "Origin: https://example.com" \
-H "Access-Control-Request-Method: POST" \
-H "Access-Control-Request-Headers: content-type"

Response includes:
access-control-allow-origin: https://example.com
access-control-allow-methods: OPTIONS, GET, POST, DELETE, PUT

4) GET responses still include CORS headers, but browsers never reach GET if preflight fails:
access-control-allow-origin: *

Impact
Any browser client calling api.spotify.com with Authorization (which triggers preflight) is blocked. We are seeing this across multiple independent web apps.

Observed: 2026-07-22 around 15:42 UTC

Please investigate CORS handling for OPTIONS requests to api.spotify.com when an Origin header is present.