Merge pull request #318 from chelo-kjml/master

'Access-Control-Allow-Private-Network = true' header for http response
corydolphin · Apr 11, 2023 · b2c4da1 · b2c4da1
2 parents cad70b3 + 24070be
commit b2c4da1
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/flask_cors/core.py b/flask_cors/core.py
@@ -29,10 +29,12 @@
 ACL_EXPOSE_HEADERS = 'Access-Control-Expose-Headers'
 ACL_CREDENTIALS = 'Access-Control-Allow-Credentials'
 ACL_MAX_AGE = 'Access-Control-Max-Age'
+ACL_RESPONSE_PRIVATE_NETWORK = 'Access-Control-Allow-Private-Network'
 
 # Request Header
 ACL_REQUEST_METHOD = 'Access-Control-Request-Method'
 ACL_REQUEST_HEADERS = 'Access-Control-Request-Headers'
+ACL_REQUEST_HEADER_PRIVATE_NETWORK = 'Access-Control-Request-Private-Network'
 
 ALL_METHODS = ['GET', 'HEAD', 'POST', 'OPTIONS', 'PUT', 'PATCH', 'DELETE']
 CONFIG_OPTIONS = ['CORS_ORIGINS', 'CORS_METHODS', 'CORS_ALLOW_HEADERS',
@@ -188,6 +190,10 @@ def get_cors_headers(options, request_headers, request_method):
     if options.get('supports_credentials'):
         headers[ACL_CREDENTIALS] = 'true'  # case sensitive
 
+    if ACL_REQUEST_HEADER_PRIVATE_NETWORK in request_headers \
+            and request_headers.get(ACL_REQUEST_HEADER_PRIVATE_NETWORK) == 'true':
+        headers[ACL_RESPONSE_PRIVATE_NETWORK] = 'true'
+
     # This is a preflight request
     # http://www.w3.org/TR/cors/#resource-preflight-requests
     if request_method == 'OPTIONS':