feature: deprecated vendored CORSMiddleware (#882)

* feature: remove vendoring of CORSMiddleware

* update changelog

Author: vincentsarago

CHANGES.md

@@ -2,6 +2,11 @@
 
 ## [Unreleased]
 
+### Fixed 
+
+- swap usage of vendored `CORSMiddleware` for the official one from starlette
+- add deprecatation warning for `stac_fastapi.api.middleware.CORSMiddleware`
+
 ## [6.2.0] - 2026-01-13
 
 ### Removed

stac_fastapi/api/stac_fastapi/api/app.py

@@ -13,10 +13,11 @@
 from stac_pydantic.shared import MimeTypes
 from stac_pydantic.version import STAC_VERSION
 from starlette.middleware import Middleware
+from starlette.middleware.cors import CORSMiddleware
 from starlette.responses import Response
 
 from stac_fastapi.api.errors import DEFAULT_STATUS_CODES, add_exception_handlers
-from stac_fastapi.api.middleware import CORSMiddleware, ProxyHeaderMiddleware
+from stac_fastapi.api.middleware import ProxyHeaderMiddleware
 from stac_fastapi.api.models import (
     APIRequest,
     CollectionUri,
@@ -126,7 +127,14 @@ class StacApi:
         default=attr.Factory(
             lambda: [
                 Middleware(BrotliMiddleware),
-                Middleware(CORSMiddleware),
+                Middleware(
+                    CORSMiddleware,
+                    # Set CORS defaults to those recommended by the STAC API spec
+                    allow_origins=["*"],
+                    allow_methods=["OPTIONS", "POST", "GET"],
+                    allow_headers=["Content-Type"],
+                    max_age=600,
+                ),
                 Middleware(ProxyHeaderMiddleware),
             ]
         )

stac_fastapi/api/stac_fastapi/api/middleware.py

@@ -3,6 +3,7 @@
 import contextlib
 import re
 import typing
+import warnings
 from http.client import HTTP_PORT, HTTPS_PORT
 from typing import List, Optional, Tuple
 
@@ -31,17 +32,25 @@ def __init__(
         allow_origin_regex: typing.Optional[str] = None,
         expose_headers: typing.Sequence[str] = (),
         max_age: int = 600,
+        **kwargs: typing.Any,
     ) -> None:
         """Create CORS middleware."""
+        warnings.warn(
+            """stac_fastapi.api.middleware.CORSMiddleware is deprecated and
+            will be removed in a future release.
+            Please use starlette.middleware.cors.CORSMiddleware instead.""",
+            DeprecationWarning,
+        )
         super().__init__(
             app,
-            allow_origins,
-            allow_methods,
-            allow_headers,
-            allow_credentials,
-            allow_origin_regex,
-            expose_headers,
-            max_age,
+            allow_origins=allow_origins,
+            allow_methods=allow_methods,
+            allow_headers=allow_headers,
+            allow_credentials=allow_credentials,
+            allow_origin_regex=allow_origin_regex,
+            expose_headers=expose_headers,
+            max_age=max_age,
+            **kwargs,
         )