From d39171c77d667e8626347723875fc215fb2fd06a Mon Sep 17 00:00:00 2001 From: Ardis Lu Date: Sat, 18 Sep 2021 14:24:26 -0700 Subject: [PATCH] Add full CORS response headers Separate OPTIONS preflight from other requests and remove wildcard Allow headers to permit Allow-Credentials --- cors/index.js | 25 ++++++++++++++++++------- 1 file changed, 18 insertions(+), 7 deletions(-) diff --git a/cors/index.js b/cors/index.js index a358d1c..828513c 100644 --- a/cors/index.js +++ b/cors/index.js @@ -2,13 +2,24 @@ async function handleRequest(request) { const url = new URL(request.url); const queryString = decodeURIComponent(url.search.substring(1)); - let response = await fetch(queryString); - response = new Response(response.body, response); - response.headers.set('Access-Control-Allow-Origin', '*'); - response.headers.set('Access-Control-Allow-Headers', '*'); - response.headers.set('Access-Control-Allow-Methods', '*'); - response.headers.set('Access-Control-Expose-Headers', '*'); - response.headers.set('Access-Control-Max-Age', '86400'); + let response; + if (request.method === 'OPTIONS') { + response = new Response(); + response.headers.set('Access-Control-Allow-Origin', request.headers.get('Origin')); + response.headers.set('Access-Control-Allow-Methods', request.headers.get('Access-Control-Request-Method')); + response.headers.set('Access-Control-Allow-Headers', request.headers.get('Access-Control-Request-Headers')); + response.headers.set('Access-Control-Allow-Credentials', 'true'); + response.headers.set('Access-Control-Max-Age', '86400'); + response.headers.append('Vary', 'Origin'); + } + else { + response = await fetch(queryString); + response = new Response(response.body, response); + response.headers.set('Access-Control-Allow-Origin', request.headers.get('Origin')); + response.headers.set('Access-Control-Allow-Credentials', 'true'); + response.headers.set('Access-Control-Expose-Headers', '*, Authorization'); + response.headers.append('Vary', 'Origin'); + } return response; } -- 2.47.3