@@ -9,6 +9,7 @@ import { WebSocket, WebSocketServer } from "ws";
 import { captureLogs } from "../tests/logs.ts";
 import { ProxyError } from "./Proxy.ts";
 import { makeHttpProxy, type HttpAccess, type HttpRoute } from "./HttpProxy.ts";
+import { sharedRoutes } from "./host/Endpoints.ts";
 
 const listen = (server: Server | NetServer, options?: { readonly beforeClose?: () => void }) =>
   Effect.acquireRelease(
@@ -746,6 +747,54 @@ it.live("adds a route's default headers only when the client sent none", () =>
   ).pipe(Effect.provide(NodeServices.layer)),
 );
 
+it.live(
+  "leaves CORS on the functions route to the function while other routes keep the gateway's",
+  () =>
+    Effect.scoped(
+      Effect.gen(function* () {
+        const backend = createServer((incoming, response) => {
+          if (incoming.headers.origin === "https://app.example.com")
+            response.setHeader("access-control-allow-origin", "https://app.example.com");
+          response.statusCode = incoming.method === "OPTIONS" ? 403 : 200;
+          response.end(incoming.method);
+        });
+        const backendAddress = yield* listen(backend);
+        const proxy = yield* makeHttpProxy({ host: "127.0.0.1", port: 0 });
+        const keys = {
+          publishableKey: "sb_publishable_example",
+          secretKey: "sb_secret_example",
+          anonKey: "anon.jwt.value",
+          serviceRoleKey: "service.role.jwt",
+        };
+        yield* proxy.setRoutes([
+          ...(
+            sharedRoutes({ service: "functions" }, "http", keys, () => Effect.die("unused")) ?? []
+          ).map((route) => ({ ...route, id: "functions", target: Effect.succeed(backendAddress) })),
+          { id: "rest", prefix: "/rest/v1", target: Effect.succeed(backendAddress) },
+        ]);
+        const client = yield* HttpClient.HttpClient;
+        const send = (method: "OPTIONS" | "POST", path: string, origin: string) =>
+          client.execute(
+            HttpClientRequest.make(method)(`http://127.0.0.1:${proxy.port}${path}`).pipe(
+              HttpClientRequest.setHeader("origin", origin),
+            ),
+          );
+
+        const preflight = yield* send("OPTIONS", "/functions/v1/fn", "https://other.example.com");
+        expect(preflight.status).toBe(403);
+        expect(preflight.headers["access-control-allow-origin"]).toBeUndefined();
+        const denied = yield* send("POST", "/functions/v1/fn", "https://other.example.com");
+        expect(yield* denied.text).toBe("POST");
+        expect(denied.headers["access-control-allow-origin"]).toBeUndefined();
+        const allowed = yield* send("POST", "/functions/v1/fn", "https://app.example.com");
+        expect(allowed.headers["access-control-allow-origin"]).toBe("https://app.example.com");
+        const rest = yield* send("OPTIONS", "/rest/v1/todos", "https://other.example.com");
+        expect(rest.status).toBe(204);
+        expect(rest.headers["access-control-allow-origin"]).toBe("*");
+      }),
+    ).pipe(Effect.provide(Layer.mergeAll(NodeHttpClient.layerNodeHttp, NodeServices.layer))),
+);
+
 it.live("returns a gateway error naming the route and cause when a target cannot wake", () => {
   const logs: Array<string> = [];
   return Effect.scoped(
@@ -757,15 +806,25 @@ it.live("returns a gateway error naming the route and cause when a target cannot
           prefix: "/",
           target: Effect.fail(new ProxyError({ message: "readiness failed" })),
         },
+        {
+          id: "functions",
+          prefix: "/functions/v1",
+          upstreamCors: true,
+          target: Effect.fail(new ProxyError({ message: "readiness failed" })),
+        },
       ]);
       const client = yield* HttpClient.HttpClient;
       const response = yield* client.get(`http://127.0.0.1:${proxy.port}/`);
       expect(response.status).toBe(502);
       expect(response.headers["access-control-allow-origin"]).toBe("*");
       expect(yield* response.text).toBe("Bad Gateway");
-      expect(logs).toHaveLength(1);
+      const functions = yield* client.get(`http://127.0.0.1:${proxy.port}/functions/v1/fn`);
+      expect(functions.status).toBe(502);
+      expect(functions.headers["access-control-allow-origin"]).toBe("*");
+      expect(logs).toHaveLength(2);
       expect(logs[0]).toContain("Route rest request failed");
       expect(logs[0]).toContain("readiness failed");
+      expect(logs[1]).toContain("Route functions request failed");
     }),
   ).pipe(
     Effect.provide(
 
@@ -37,6 +37,8 @@ export interface HttpRoute {
   readonly keyRewrite?: HttpRouteKeyRewrite;
   /** Sends each write over a fresh upstream connection; reads still share the pool and its retry. */
   readonly freshWrites?: boolean;
+  /** Leaves CORS, preflights included, to the upstream, like Edge Functions on the platform. */
+  readonly upstreamCors?: boolean;
 }
 
 /** Configures Supabase API-key rewriting for one HTTP route. */
@@ -447,7 +449,7 @@ const forward = Effect.fn("HttpProxy.forward")(function* (
           sent.bytes += chunk.length;
         });
         response.once("finish", onFinish);
-        setCors(response, request);
+        if (route.upstreamCors !== true) setCors(response, request);
         response.statusCode = value.statusCode ?? 502;
         for (const [name, header] of Object.entries(value.headers)) {
           if (header !== undefined && !hopByHop.has(name.toLowerCase()))
@@ -676,8 +678,9 @@ export const makeHttpProxy = (options: {
               const route = yield* Ref.get(routes).pipe(
                 Effect.map((current) => routeFor(request.url ?? "/", current)),
               );
-              setCors(response, request);
-              if (request.method === "OPTIONS") respond(response, sent, 204);
+              if (route?.upstreamCors !== true) setCors(response, request);
+              if (request.method === "OPTIONS" && route?.upstreamCors !== true)
+                respond(response, sent, 204);
               else if (route === undefined) respond(response, sent, 404, "Not Found");
               else {
                 yield* proxyRequest(request, response, route, agent, sent).pipe(
 
@@ -11,7 +11,13 @@ export type NetworkRuntime = "native" | "docker" | "podman";
 /* `target` serves a route from another backend than its endpoint's, like PostgREST's admin port. */
 type RouteContribution = Pick<
   HttpRoute,
-  "prefix" | "upstreamPrefix" | "upstreamHost" | "addHeaders" | "forwardedPrefix" | "keyRewrite"
+  | "prefix"
+  | "upstreamPrefix"
+  | "upstreamHost"
+  | "addHeaders"
+  | "forwardedPrefix"
+  | "keyRewrite"
+  | "upstreamCors"
 > &
   Partial<Pick<HttpRoute, "target">>;
 
 
@@ -8,6 +8,7 @@ import { defaultFunctionsBootstrap } from "./generated/serve-main-bundle.ts";
 type ServeOptions = {
   readonly handler: (request: Request) => Promise<Response>;
   readonly onListen: () => void;
+  readonly onError: (error: unknown) => Response;
 };
 
 class MissingFixture extends Data.TaggedError("MissingFixture") {}
@@ -263,6 +264,8 @@ describe("stack-owned functions bootstrap", () => {
       );
       const invalidSignature = yield* invoke(wrongToken);
       expect(invalidSignature.status).toBe(401);
+      expect(invalidSignature.headers.get("access-control-allow-origin")).toBe("*");
+      expect(invalidSignature.headers.get("access-control-expose-headers")).toBe("sb-error-code");
       expect(yield* Effect.tryPromise(() => invalidSignature.json())).toMatchObject({
         code: "UNAUTHORIZED_JWT",
       });
@@ -356,6 +359,10 @@ describe("stack-owned functions bootstrap", () => {
         registered.handler(new Request("http://127.0.0.1/missing")),
       );
       expect(missing.status).toBe(404);
+      expect(missing.headers.get("access-control-allow-origin")).toBe("*");
+      const crashed = registered.onError(new Error("boom"));
+      expect(crashed.status).toBe(500);
+      expect(crashed.headers.get("access-control-allow-origin")).toBe("*");
       expect(yield* Effect.tryPromise(() => missing.text())).toBe("Function not found");
     }).pipe(Effect.scoped, Effect.provide(NodeServices.layer)),
   );
@@ -519,6 +526,7 @@ describe("stack-owned functions bootstrap", () => {
           handler(new Request("http://127.0.0.1/hello")),
         );
         expect(response.status).toBe(500);
+        expect(response.headers.get("access-control-allow-origin")).toBe("*");
         expect(yield* Effect.tryPromise(() => response.json())).toMatchObject({
           code: "WORKER_ERROR",
         });
 
@@ -208,10 +208,17 @@ const getResponse = (
   return new Response(body, { status, headers });
 };
 
+/** Lets browsers read router errors on requests that skip the preflight; preflights still fail. */
+const ERROR_CORS_HEADERS = {
+  "Access-Control-Allow-Origin": "*",
+  "Access-Control-Allow-Headers": "authorization, x-client-info, apikey",
+  "Access-Control-Expose-Headers": "sb-error-code",
+};
+
 const getAuthErrorResponse = ({ code, message = "Invalid JWT" }: AuthFailure) =>
   getResponse({ code, message, msg: message }, STATUS_CODE.Unauthorized, {
+    ...ERROR_CORS_HEADERS,
     "sb-error-code": code,
-    "Access-Control-Expose-Headers": "sb-error-code",
   });
 
 const getWorkerErrorResponse = (error: unknown) => {
@@ -223,6 +230,7 @@ const getWorkerErrorResponse = (error: unknown) => {
           message: SB_SPECIFIC_ERROR_REASON[sbCode],
         },
         sbCode,
+        ERROR_CORS_HEADERS,
       );
     }
   }
@@ -232,6 +240,7 @@ const getWorkerErrorResponse = (error: unknown) => {
       message: "Request failed due to an internal server error",
     },
     STATUS_CODE.InternalServerError,
+    ERROR_CORS_HEADERS,
   );
 };
 
@@ -423,9 +432,11 @@ Deno.serve({
         if (pathname === "/_internal/metric")
           return Response.json(yield* foreign(() => EdgeRuntime.getRuntimeMetrics()));
         const functionName = pathname.split("/")[1];
-        if (!functionName) return getResponse("Function not found", STATUS_CODE.NotFound);
+        if (!functionName)
+          return getResponse("Function not found", STATUS_CODE.NotFound, ERROR_CORS_HEADERS);
         const config = yield* functionConfig(functionName);
-        if (!config) return getResponse("Function not found", STATUS_CODE.NotFound);
+        if (!config)
+          return getResponse("Function not found", STATUS_CODE.NotFound, ERROR_CORS_HEADERS);
         yield* warnPlainDenoConfig(functionName, config);
         if (request.method !== "OPTIONS" && config.verifyJWT) {
           const token = getAuthToken(request);
@@ -521,5 +532,6 @@ Deno.serve({
         message: "Request failed due to an internal server error",
       },
       500,
+      ERROR_CORS_HEADERS,
     ),
 });
@@ -119,7 +119,14 @@ export const sharedRoutes = (
         { prefix: route, upstreamPrefix: "/", keyRewrite: { policy: "bearer", keys } },
       ];
     case "functions":
-      return [{ prefix: route, upstreamPrefix: "/", keyRewrite: { policy: "sb-api-key", keys } }];
+      return [
+        {
+          prefix: route,
+          upstreamPrefix: "/",
+          keyRewrite: { policy: "sb-api-key", keys },
+          upstreamCors: true,
+        },
+      ];
     default:
       return [{ prefix: route, upstreamPrefix: "/" }];
   }