Access-Control-Allow-Headers does not allow * as accepted value

[alfonsoabad]

I have been trying to implement Ext js 4 with FRAPI , and I had to change Access-Control-Allow-Headers: * to avoid the "Request header field X-Requested-With is not allowed by Access-Control-Allow-Headers" error .

For more info the same issue related here

http://stackoverflow.com/questions/8719276/cors-with-php-headers

with this small change I got the Ext 4 js grid working in rest proxy mode , connected to the FRAPI

[dshafik]

@alfonsoabad The way this patch is written right now is a security risk, essentially it allows the client to set what headers it's allowed to send. While our intention was to allow any headers.

Also, because this is a whitelist, not having the header at all will mean that no additional headers can be sent — but that should fix your issue.

This needs more discussion and changes to the patch before we can accept it.

[clayhinson]

moved this PR to 0.2.0 pending further discussion / modification.