Skip to content

Commit

Permalink
Add CORS headers to non-preflight OPTIONS too (#85)
Browse files Browse the repository at this point in the history 
Non preflight OPTIONS requests should work with CORS too.
This change is removing abort in actual request CORS handler for
OPTIONS request, so the client can receive the necessary headers
on such request.
  • Loading branch information
@pjediny @rs
pjediny authored and rs committed Jul 9, 2019
1 parent f210262 commit db0fe48
Show file tree
Hide file tree
Showing 2 changed files with 22 additions and 34 deletions.
4 changes: 0 additions & 4 deletions cors.go
View file
Expand Up @@ -316,10 +316,6 @@ func (c *Cors) handleActualRequest(w http.ResponseWriter, r *http.Request) {
headers := w.Header()
origin := r.Header.Get("Origin")

if r.Method == http.MethodOptions {
c.logf(" Actual request no headers added: method == %s", r.Method)
return
}
// Always set Vary, see https://github.com/rs/cors/issues/10
headers.Add("Vary", "Origin")
if origin == "" {
Expand Down
52 changes: 22 additions & 30 deletions cors_test.go
View file
Expand Up @@ -67,7 +67,7 @@ func TestSpec(t *testing.T) {
"Origin": "http://foobar.com",
},
map[string]string{
"Vary": "Origin",
"Vary": "Origin",
"Access-Control-Allow-Origin": "*",
},
},
Expand All @@ -82,7 +82,7 @@ func TestSpec(t *testing.T) {
"Origin": "http://foobar.com",
},
map[string]string{
"Vary": "Origin",
"Vary": "Origin",
"Access-Control-Allow-Origin": "*",
"Access-Control-Allow-Credentials": "true",
},
Expand All @@ -97,7 +97,7 @@ func TestSpec(t *testing.T) {
"Origin": "http://foobar.com",
},
map[string]string{
"Vary": "Origin",
"Vary": "Origin",
"Access-Control-Allow-Origin": "http://foobar.com",
},
},
Expand All @@ -111,7 +111,7 @@ func TestSpec(t *testing.T) {
"Origin": "http://foo.bar.com",
},
map[string]string{
"Vary": "Origin",
"Vary": "Origin",
"Access-Control-Allow-Origin": "http://foo.bar.com",
},
},
Expand Down Expand Up @@ -153,7 +153,7 @@ func TestSpec(t *testing.T) {
"Origin": "http://foobar.com",
},
map[string]string{
"Vary": "Origin",
"Vary": "Origin",
"Access-Control-Allow-Origin": "http://foobar.com",
},
},
Expand All @@ -170,7 +170,7 @@ func TestSpec(t *testing.T) {
"Authorization": "secret",
},
map[string]string{
"Vary": "Origin",
"Vary": "Origin",
"Access-Control-Allow-Origin": "http://foobar.com",
},
},
Expand Down Expand Up @@ -203,7 +203,7 @@ func TestSpec(t *testing.T) {
"Access-Control-Request-Method": "GET",
},
map[string]string{
"Vary": "Origin, Access-Control-Request-Method, Access-Control-Request-Headers",
"Vary": "Origin, Access-Control-Request-Method, Access-Control-Request-Headers",
"Access-Control-Allow-Origin": "http://example.com/",
"Access-Control-Allow-Methods": "GET",
"Access-Control-Max-Age": "10",
Expand All @@ -221,7 +221,7 @@ func TestSpec(t *testing.T) {
"Access-Control-Request-Method": "PUT",
},
map[string]string{
"Vary": "Origin, Access-Control-Request-Method, Access-Control-Request-Headers",
"Vary": "Origin, Access-Control-Request-Method, Access-Control-Request-Headers",
"Access-Control-Allow-Origin": "http://foobar.com",
"Access-Control-Allow-Methods": "PUT",
},
Expand Down Expand Up @@ -254,7 +254,7 @@ func TestSpec(t *testing.T) {
"Access-Control-Request-Headers": "X-Header-2, X-HEADER-1",
},
map[string]string{
"Vary": "Origin, Access-Control-Request-Method, Access-Control-Request-Headers",
"Vary": "Origin, Access-Control-Request-Method, Access-Control-Request-Headers",
"Access-Control-Allow-Origin": "http://foobar.com",
"Access-Control-Allow-Methods": "GET",
"Access-Control-Allow-Headers": "X-Header-2, X-Header-1",
Expand All @@ -273,7 +273,7 @@ func TestSpec(t *testing.T) {
"Access-Control-Request-Headers": "X-Requested-With",
},
map[string]string{
"Vary": "Origin, Access-Control-Request-Method, Access-Control-Request-Headers",
"Vary": "Origin, Access-Control-Request-Method, Access-Control-Request-Headers",
"Access-Control-Allow-Origin": "http://foobar.com",
"Access-Control-Allow-Methods": "GET",
"Access-Control-Allow-Headers": "X-Requested-With",
Expand All @@ -292,7 +292,7 @@ func TestSpec(t *testing.T) {
"Access-Control-Request-Headers": "X-Header-2, X-HEADER-1",
},
map[string]string{
"Vary": "Origin, Access-Control-Request-Method, Access-Control-Request-Headers",
"Vary": "Origin, Access-Control-Request-Method, Access-Control-Request-Headers",
"Access-Control-Allow-Origin": "http://foobar.com",
"Access-Control-Allow-Methods": "GET",
"Access-Control-Allow-Headers": "X-Header-2, X-Header-1",
Expand Down Expand Up @@ -326,7 +326,7 @@ func TestSpec(t *testing.T) {
"Access-Control-Request-Headers": "origin",
},
map[string]string{
"Vary": "Origin, Access-Control-Request-Method, Access-Control-Request-Headers",
"Vary": "Origin, Access-Control-Request-Method, Access-Control-Request-Headers",
"Access-Control-Allow-Origin": "http://foobar.com",
"Access-Control-Allow-Methods": "GET",
"Access-Control-Allow-Headers": "Origin",
Expand All @@ -343,7 +343,7 @@ func TestSpec(t *testing.T) {
"Origin": "http://foobar.com",
},
map[string]string{
"Vary": "Origin",
"Vary": "Origin",
"Access-Control-Allow-Origin": "http://foobar.com",
"Access-Control-Expose-Headers": "X-Header-1, X-Header-2",
},
Expand All @@ -360,7 +360,7 @@ func TestSpec(t *testing.T) {
"Access-Control-Request-Method": "GET",
},
map[string]string{
"Vary": "Origin, Access-Control-Request-Method, Access-Control-Request-Headers",
"Vary": "Origin, Access-Control-Request-Method, Access-Control-Request-Headers",
"Access-Control-Allow-Origin": "http://foobar.com",
"Access-Control-Allow-Methods": "GET",
"Access-Control-Allow-Credentials": "true",
Expand All @@ -377,7 +377,7 @@ func TestSpec(t *testing.T) {
"Access-Control-Request-Method": "GET",
},
map[string]string{
"Vary": "Origin, Access-Control-Request-Method, Access-Control-Request-Headers",
"Vary": "Origin, Access-Control-Request-Method, Access-Control-Request-Headers",
"Access-Control-Allow-Origin": "*",
"Access-Control-Allow-Methods": "GET",
},
Expand All @@ -388,8 +388,13 @@ func TestSpec(t *testing.T) {
AllowedOrigins: []string{"http://foobar.com"},
},
"OPTIONS",
map[string]string{},
map[string]string{},
map[string]string{
"Origin": "http://foobar.com",
},
map[string]string{
"Vary": "Origin",
"Access-Control-Allow-Origin": "http://foobar.com",
},
},
}
for i := range cases {
Expand Down Expand Up @@ -475,19 +480,6 @@ func TestHandlePreflightNoOptionsAbortion(t *testing.T) {
assertHeaders(t, res.Header(), map[string]string{})
}

func TestHandleActualRequestAbortsOptionsMethod(t *testing.T) {
s := New(Options{
AllowedOrigins: []string{"http://foo.com"},
})
res := httptest.NewRecorder()
req, _ := http.NewRequest("OPTIONS", "http://example.com/foo", nil)
req.Header.Add("Origin", "http://example.com/")

s.handleActualRequest(res, req)

assertHeaders(t, res.Header(), map[string]string{})
}

func TestHandleActualRequestInvalidOriginAbortion(t *testing.T) {
s := New(Options{
AllowedOrigins: []string{"http://foo.com"},
Expand Down

0 comments on commit db0fe48

Please sign in to comment.