Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

III-4099 Allow any CORS origin #729

Merged
merged 2 commits into from
Sep 8, 2021
Merged

III-4099 Allow any CORS origin #729

merged 2 commits into from
Sep 8, 2021

Conversation

bertramakers
Copy link
Contributor

@bertramakers bertramakers commented Sep 7, 2021 •
edited
Loading

Changed

  • Any CORS origin is now allowed (if we don't specify any allowed origins, the package we use allows every origin)

Removed

  • OPTIONS responses no longer have a Access-Control-Allow-Credentials: true header (which would allow the browser to send cookies via CORS requests which we don't use nor want)

Ticket: https://jira.uitdatabank.be/browse/III-4099

@bertramakers
Don't overwrite default cors.allowOrigin and cors.allowCredentials
e0eceeb 
The default for cors.allowCredentials is * which is what we want, and we don't need cors.allowCredentials because our API does not work with cookies
@bertramakers
Remove example cors config parameter
82d7138
@bertramakers bertramakers merged commit 35c5956 into master Sep 8, 2021
@bertramakers bertramakers deleted the feature/III-4099-allow-any-cors-origin branch September 8, 2021 09:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@LucWollants LucWollants LucWollants approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@bertramakers @LucWollants