Allow metrics custom headers in cors (#640)

* Allow metrics custom headers in cors

* Update NEWS.md

NEWS.md

@@ -3,6 +3,8 @@
 ## 5.0.2
 Released 2020-mm-dd
 
+- Updated allowed list of custom headers with the ones for metrics
+
 
 ## 5.0.1
 Released 2020-01-27

lib/api/middlewares/cors.js

@@ -7,6 +7,9 @@ module.exports = function cors (extraHeaders = []) {
             'X-Prototype-Version',
             'X-CSRF-Token',
             'Authorization',
+            'Carto-Source-Lib',
+            'Carto-Source-Context',
+            'Carto-Source-Context-Id',
             ...extraHeaders
         ];
 

test/acceptance/app-configuration-test.js

@@ -9,7 +9,10 @@ const accessControlHeaders = [
     'X-Requested-With',
     'X-Prototype-Version',
     'X-CSRF-Token',
-    'Authorization'
+    'Authorization',
+    'Carto-Source-Lib',
+    'Carto-Source-Context',
+    'Carto-Source-Context-Id'
 ].join(', ');
 
 const exposedHeaders = [