Hi there, enabling cors on admin api doesn't seem to be adding headers into the response. I am following this comment from a few years ago by someone with a similar issue I am reproducing using the quick start. Not sure if i'm missing something or a bug. Below is my config (taken from the comment i linked) and the results of curling both the public and admin api with the missing headers.

# hydra.yml
serve:
  admin:
    cors:
      enabled: true
      allowed_origins:
        - <http://localhost:3000>
      allowed_methods:
        - POST
        - GET
        - PUT
        - PATCH
        - DELETE
      allowed_headers:
        - Authorization
      exposed_headers:
        - Content-Type
  public:
    cors:
      enabled: true
      allowed_origins:
        - <http://localhost:3000>
...

# Curl to public api

curl '<http://localhost:4444/.well-known/openid-configuration>' -vvv -H 'User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:82.0) Gecko/20100101 Firefox/82.0' -H 'Accept: application/json' -H 'Accept-Language: en-US,en;q=0.5' --compressed -H 'Origin: <http://localhost:3000>' -H 'Connection: keep-alive' -H 'Referer: <http://localhost:3000/>' -H 'Cache-Control: max-age=0'
*   Trying 127.0.0.1:4444...
* Connected to localhost (127.0.0.1) port 4444 (#0)
> GET /.well-known/openid-configuration HTTP/1.1
> Host: localhost:4444
> Accept-Encoding: deflate, gzip
> User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:82.0) Gecko/20100101 Firefox/82.0
> Accept: application/json
> Accept-Language: en-US,en;q=0.5
> Origin: <http://localhost:3000>
> Connection: keep-alive
> Referer: <http://localhost:3000/>
> Cache-Control: max-age=0
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 200 OK
< Access-Control-Allow-Credentials: true
< Access-Control-Allow-Origin: <http://localhost:3000>
< Access-Control-Expose-Headers: Content-Type
< Cache-Control: private, no-cache, no-store, must-revalidate
< Content-Type: application/json; charset=utf-8
< Vary: Origin
< Date: Sun, 09 Apr 2023 07:04:16 GMT
< Content-Length: 1508
<

# Curl to admin api

curl '<http://localhost:4445/admin/clients>' -vvv -H 'User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:82.0) Gecko/20100101 Firefox/82.0' -H 'Accept: application/json' -H 'Accept-Language: en-US,en;q=0.5' --compressed -H 'Origin: <http://localhost:3000>' -H 'Connection: keep-alive' -H 'Referer: <http://localhost:3000/>' -H 'Cache-Control: max-age=0'
*   Trying 127.0.0.1:4445...
* Connected to localhost (127.0.0.1) port 4445 (#0)
> GET /admin/clients HTTP/1.1
> Host: localhost:4445
> Accept-Encoding: deflate, gzip
> User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:82.0) Gecko/20100101 Firefox/82.0
> Accept: application/json
> Accept-Language: en-US,en;q=0.5
> Origin: <http://localhost:3000>
> Connection: keep-alive
> Referer: <http://localhost:3000/>
> Cache-Control: max-age=0
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 200 OK
< Cache-Control: private, no-cache, no-store, must-revalidate
< Content-Type: application/json; charset=utf-8
< Link: </admin/clients?page_size=250&page_token=eyJvZmZzZXQiOiIwIiwidiI6Mn0>; rel="first",</admin/clients?page_size=250&page_token=eyJvZmZzZXQiOiIyNTAiLCJ2IjoyfQ>; rel="next",</admin/clients?page_size=250&page_token=eyJvZmZzZXQiOiItMjUwIiwidiI6Mn0>; rel="prev"
< X-Total-Count: 0
< Date: Sun, 09 Apr 2023 07:03:14 GMT
< Content-Length: 3
<

So I am expecting to see the below headers inside the above response.

< Access-Control-Allow-Credentials: true
< Access-Control-Allow-Origin: <http://localhost:3000>
< Access-Control-Expose-Headers: Content-Type