Core: Register CORS middleware before index.json route

[jonathan-fulton]

Description

Fixes #33724

The /index.json endpoint was missing CORS headers because the route handler was registered before the CORS middleware. This broke Storybook Composition when composing local Storybooks running on different ports.

Root Cause

The middleware registration order in dev-server.ts was:

1. registerIndexJsonRoute() ❌ Route registered first
2. app.use(compression(...))
3. app.use(getAccessControlMiddleware(...)) ❌ CORS middleware registered after

Since the /index.json route handler sends the response directly without calling next(), the CORS middleware never had a chance to add headers.

Solution

Moved the middleware registration order so that CORS headers are applied to all routes:

1. app.use(compression(...))
2. app.use(getAccessControlMiddleware(...)) ✅ CORS middleware first
3. app.use(getCachingMiddleware())
4. registerIndexJsonRoute() ✅ Route registered after

Testing

• Local testing with Storybook Composition confirms CORS headers are now present on /index.json
• Verified Access-Control-Allow-Origin: * header is returned

What this fixes

• Storybook Composition now works correctly across different ports
• No more CORS errors when fetching /index.json from a composed Storybook

Summary by CodeRabbit

• Bug Fixes
  • Fixed cross-origin access to the index endpoint to ensure proper functionality for requests from different domains.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

[coderabbitai]

📝 Walkthrough

Walkthrough

The dev server's /index.json route registration has been reordered to occur after CORS and caching middleware are initialized, ensuring the route properly receives CORS headers. A clarifying comment about CORS ordering was added alongside the reordering.

Changes

Cohort / File(s)	Summary
Dev Server Middleware Ordering code/core/src/core-server/dev-server.ts	Reordered /index.json route registration to execute after CORS and caching middleware setup; added clarifying comment regarding CORS header ordering.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

✨ Finishing touches

• 📝 Generate docstrings

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[storybook-app-bot]

Package Benchmarks

^{Commit: 703fd09, ran on 13 February 2026 at 14:14:28 UTC}

The following packages have significant changes to their size or dependencies:

@storybook/cli

	Before	After	Difference
Dependency count	183	183	0
Self size	779 KB	776 KB	🎉 -3 KB 🎉
Dependency size	67.62 MB	67.57 MB	🎉 -50 KB 🎉
Bundle Size Analyzer	Link	Link

create-storybook

	Before	After	Difference
Dependency count	50	50	0
Self size	1.04 MB	1000 KB	🎉 -44 KB 🎉
Dependency size	36.93 MB	36.93 MB	🎉 -6 KB 🎉
Bundle Size Analyzer	node	node

@storybook/preact

	Before	After	Difference
Dependency count	2	2	0
Self size	23 KB	16 KB	🎉 -7 KB 🎉
Dependency size	32 KB	32 KB	0 B
Bundle Size Analyzer	Link	Link