mirror of
https://github.com/hanzoai/gateway.git
synced 2026-10-30 15:04:44 +00:00
zooqueenandHanzo Dev
b12da035ec
0d252bf stopped answering preflights with a hard-coded header list and started
echoing the names the browser actually asked for. The fixture was not moved
with it, so it still asserted the old list and a `Vary` of just Origin:
Access-Control-Allow-Headers have: content-type, origin
want: Content-Type, Authorization, X-User-Id, …
Vary have: Origin, Access-Control-Request-Headers
want: Origin
The implementation is the correct half of that. It echoes the ask, so it names
Access-Control-Request-Headers in Vary — the answer genuinely varies on it now,
and a cache that did not know would hand one script's grant to another.
The whole gate passes here: legacy unit packages, the fixture harness with the
same -gateway_startup_wait CI passes, the untagged build, and vet over both
tag sets.
Co-authored-by: Hanzo Dev <[email protected]>
27 lines
1.3 KiB
JSON
27 lines
1.3 KiB
JSON
{
|
|
"@comment": "Preflight from an ALLOWLISTED origin. corsPreflightMiddleware (routes.go) runs before routing and answers 204 with the Origin ECHOED — never '*' — alongside credentials:true, so a shared cache can never serve one origin's grant to another. http://localhost:3000 is a baked-in dev origin in newCORSOriginAllower, the ONE allowlist this gateway has. Allow-Headers is the ask echoed back name for name (corsAllowHeaders), not a literal list — so it is exactly the Access-Control-Request-Headers above, and Vary names that header too, because the answer now depends on it.",
|
|
"in": {
|
|
"method": "OPTIONS",
|
|
"url": "http://localhost:8080/param_forwarding/some/foo/bar?a=1&b=2",
|
|
"header": {
|
|
"User-Agent": "some",
|
|
"Origin": "http://localhost:3000",
|
|
"Access-Control-Request-Method": "GET",
|
|
"Access-Control-Request-Headers": "content-type,origin"
|
|
}
|
|
},
|
|
"out": {
|
|
"status_code": 204,
|
|
"header": {
|
|
"Access-Control-Allow-Origin": ["http://localhost:3000"],
|
|
"Access-Control-Allow-Credentials": ["true"],
|
|
"Access-Control-Allow-Methods": ["GET, POST, PUT, PATCH, DELETE, OPTIONS"],
|
|
"Access-Control-Allow-Headers": ["content-type, origin"],
|
|
"Access-Control-Max-Age": ["86400"],
|
|
"Vary": ["Origin, Access-Control-Request-Headers"],
|
|
"Server": ["gateway"],
|
|
"X-Content-Type-Options": ["nosniff"]
|
|
}
|
|
}
|
|
}
|