cartodb/CartoDB-SQL-API
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

CORS: use wildcard for Access-Control-Expose-Headers and Access-Control-Allow-Headers

Browse Source
This commit is contained in:
Daniel García Aubert 2020-11-05 16:50:31 +01:00
parent 8a630186c8
commit b9834cf453
1 changed files with 3 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
lib/api/middlewares/cors.js
View File

@ -1,28 +1,10 @@
'use strict';
module.exports = function cors (extraHeaders = []) {
module.exports = function cors () {
return function (req, res, next) {
const headers = [
'X-Requested-With',
'X-Prototype-Version',
'X-CSRF-Token',
'Authorization',
'Carto-Event',
'Carto-Event-Source',
'Carto-Event-Group-Id',
...extraHeaders
];
const exposedHeaders = [
'Carto-Rate-Limit-Limit',
'Carto-Rate-Limit-Remaining',
'Carto-Rate-Limit-Reset',
'Retry-After'
];
res.header('Access-Control-Allow-Origin', '*');
res.header('Access-Control-Allow-Headers', headers.join(', '));
res.header('Access-Control-Expose-Headers', exposedHeaders.join(', '));
res.header('Access-Control-Allow-Headers', '*');
res.header('Access-Control-Expose-Headers', '*');
if (req.method === 'OPTIONS') {
return res.send();