Add full CORS response headers

Separate OPTIONS preflight from other requests and remove wildcard Allow headers to permit Allow-Credentials

diff --git a/cors/index.js b/cors/index.js
index a358d1c8804b377e5eb3ee441fbfe00ea9a5a857..828513c2d21417c3333afd9d04acd614cd6b7e42 100644 (file)
--- a/cors/index.js
+++ b/cors/index.js
@@ -2,13 +2,24 @@ async function handleRequest(request) {
   const url = new URL(request.url);
   const queryString = decodeURIComponent(url.search.substring(1));
 
-  let response = await fetch(queryString);
-  response = new Response(response.body, response);
-  response.headers.set('Access-Control-Allow-Origin', '*');
-  response.headers.set('Access-Control-Allow-Headers', '*');
-  response.headers.set('Access-Control-Allow-Methods', '*');
-  response.headers.set('Access-Control-Expose-Headers', '*');
-  response.headers.set('Access-Control-Max-Age', '86400');
+  let response;
+  if (request.method === 'OPTIONS') {
+    response = new Response();
+    response.headers.set('Access-Control-Allow-Origin', request.headers.get('Origin'));
+    response.headers.set('Access-Control-Allow-Methods', request.headers.get('Access-Control-Request-Method'));
+    response.headers.set('Access-Control-Allow-Headers', request.headers.get('Access-Control-Request-Headers'));
+    response.headers.set('Access-Control-Allow-Credentials', 'true');
+    response.headers.set('Access-Control-Max-Age', '86400');
+    response.headers.append('Vary', 'Origin');
+  }
+  else {
+    response = await fetch(queryString);
+    response = new Response(response.body, response);
+    response.headers.set('Access-Control-Allow-Origin', request.headers.get('Origin'));
+    response.headers.set('Access-Control-Allow-Credentials', 'true');
+    response.headers.set('Access-Control-Expose-Headers', '*, Authorization');
+    response.headers.append('Vary', 'Origin');
+  }
   
   return response;
 }