CORS on OPTIONS method

shiva/app.py

@@ -52,7 +52,8 @@ def before_request():
 def after_request(response):
     if getattr(g, 'cors', False):
         response.headers['Access-Control-Allow-Origin'] = g.cors
-        response.headers['Access-Control-Allow-Headers'] = 'Content-Type'
+        response.headers['Access-Control-Allow-Headers'] = \
+            'Accept, Content-Type, Origin, X-Requested-With'
 
     return response
 

shiva/decorators.py

@@ -39,25 +39,14 @@ def decorated(*args, **kwargs):
             origin = request.headers.get('Origin')
 
             # `app.config.get('CORS_ALLOWED_ORIGINS', [])` should really be the
-            # default option in `def allow_origins` for # `custom_origins` but
+            # default option in `def allow_origins` for `custom_origins` but
             # that would use `app` outside of the application context
             allowed_origins = custom_origins or \
                 app.config.get('CORS_ALLOWED_ORIGINS', [])
 
-            # Actual headers are added in `after_request`, unless it's an
-            # OPTIONS request.
+            # Actual headers are added in `after_request`
             g.cors = _get_origin(allowed_origins, origin)
 
-            if request.method == 'OPTIONS':
-                headers = {
-                    'Access-Control-Allow-Origin': origin,
-                    'Access-Control-Allow-Headers': 'Content-Type',
-                }
-                response = make_response('ok')
-                response.headers.update(headers)
-
-                return response
-
             return func(*args, **kwargs)
 
         return decorated

shiva/http.py

@@ -12,6 +12,11 @@ def __new__(cls, *args, **kwargs):
 
         return super(Resource, cls).__new__(cls, *args, **kwargs)
 
+    # Without this the shiva.decorator.allow_origins method won't get called
+    # when issuing an OPTIONS request.
+    def options(self):
+        return JSONResponse()
+
 
 class JSONResponse(Response):
     """