I seem to be at an impasse with the newest Pi-hole API. My goal is to have a local client other than the Pi-hole server execute REST calls against the Pi-hole server. I'm getting inconsistent results with the headers returned for the various calls. I've been editing the values in the webserver.headers. I’m finding that the api/auth call always returns the header "Access-Control-Allow-Headers:", regardless of the Content-Security-Policy value. The other calls never return the "Access-Control-Allow-Headers:" header. When I add that header to the webserver.headers area, the api/auth fails, with the browser returning a "Multiple Access-Control-Allow-Headers" error.
My question is: Does anyone know the right combination of Content-Security-Policy and/or custom headers to get this API to work for whatever clients I want? Security wise, this is all behind a firewall and not exposed to the greater Internet without a VPN.
The alternative is that I'll need to write a custom gateway to get to the API, which I'd rather not do. Thank you!