fix for mevdschee#889

Author: mevdschee

api.include.php

@@ -7920,7 +7920,7 @@ public function process(ServerRequestInterface $request, RequestHandlerInterface
                 $response = $this->responder->error(ErrorCode::ORIGIN_FORBIDDEN, $origin);
             } elseif ($method == 'OPTIONS') {
                 $response = ResponseFactory::fromStatus(ResponseFactory::OK);
-                $allowHeaders = $this->getProperty('allowHeaders', 'Content-Type, X-XSRF-TOKEN, X-Authorization');
+                $allowHeaders = $this->getProperty('allowHeaders', 'Content-Type, X-XSRF-TOKEN, X-Authorization, X-API-Key');
                 if ($this->debug) {
                     $allowHeaders = implode(', ', array_filter([$allowHeaders, 'X-Exception-Name, X-Exception-Message, X-Exception-File']));
                 }

api.php

@@ -7920,7 +7920,7 @@ public function process(ServerRequestInterface $request, RequestHandlerInterface
                 $response = $this->responder->error(ErrorCode::ORIGIN_FORBIDDEN, $origin);
             } elseif ($method == 'OPTIONS') {
                 $response = ResponseFactory::fromStatus(ResponseFactory::OK);
-                $allowHeaders = $this->getProperty('allowHeaders', 'Content-Type, X-XSRF-TOKEN, X-Authorization');
+                $allowHeaders = $this->getProperty('allowHeaders', 'Content-Type, X-XSRF-TOKEN, X-Authorization, X-API-Key');
                 if ($this->debug) {
                     $allowHeaders = implode(', ', array_filter([$allowHeaders, 'X-Exception-Name, X-Exception-Message, X-Exception-File']));
                 }

src/Tqdev/PhpCrudApi/Middleware/CorsMiddleware.php

@@ -46,7 +46,7 @@ public function process(ServerRequestInterface $request, RequestHandlerInterface
             $response = $this->responder->error(ErrorCode::ORIGIN_FORBIDDEN, $origin);
         } elseif ($method == 'OPTIONS') {
             $response = ResponseFactory::fromStatus(ResponseFactory::OK);
-            $allowHeaders = $this->getProperty('allowHeaders', 'Content-Type, X-XSRF-TOKEN, X-Authorization');
+            $allowHeaders = $this->getProperty('allowHeaders', 'Content-Type, X-XSRF-TOKEN, X-Authorization, X-API-Key');
             if ($this->debug) {
                 $allowHeaders = implode(', ', array_filter([$allowHeaders, 'X-Exception-Name, X-Exception-Message, X-Exception-File']));
             }

tests/functional/001_records/041_cors_pre_flight.log

@@ -5,7 +5,7 @@ Access-Control-Request-Method: POST
 Access-Control-Request-Headers: X-XSRF-TOKEN, X-Requested-With
 ===
 200
-Access-Control-Allow-Headers: Content-Type, X-XSRF-TOKEN, X-Authorization
+Access-Control-Allow-Headers: Content-Type, X-XSRF-TOKEN, X-Authorization, X-API-Key
 Access-Control-Allow-Methods: OPTIONS, GET, PUT, POST, DELETE, PATCH
 Access-Control-Max-Age: 1728000
 Access-Control-Allow-Credentials: true

tests/functional/002_auth/001_jwt_auth.log

@@ -38,7 +38,7 @@ Access-Control-Request-Method: POST
 Access-Control-Request-Headers: X-PINGOTHER, Content-Type
 ===
 200
-Access-Control-Allow-Headers: Content-Type, X-XSRF-TOKEN, X-Authorization
+Access-Control-Allow-Headers: Content-Type, X-XSRF-TOKEN, X-Authorization, X-API-Key
 Access-Control-Allow-Methods: OPTIONS, GET, PUT, POST, DELETE, PATCH
 Access-Control-Allow-Credentials: true
 Access-Control-Max-Age: 1728000