Closed MaRaSu closed 6 months ago
Thanks for raising this and for the sample code, I learned something new today!
I went with this version:
@app.before_request
def handle_preflight():
if request.method == "OPTIONS":
response = Response(status=204)
response.headers["access-control-allow-methods"] = "GET,POST,OPTIONS,HEAD"
response.headers["access-control-allow-headers"] = "content-type,x-api-key"
return response
which doesn't require changing the existing CORS logic.
I also looked at using flask-cors but your approach seems much better!
I should probably do something similar with HEAD requests, though might wait until it's actually an issue for someone!
For HTTPS-connections browser is sending OPTIONS before POST. I have nginx in front of OpenTopoData to handle SSL for HTTPS, but I do not have it configured for OPTIONS, rather all requests are passed to OpenTopoData. OpenTopoData has Flask
@app.route
handlers that include OPTIONS, but it does not seem to handle it correctly for my case: it expects OPTIONS request to have same payload or query params as GET or POST, which I think is not the case for browser sent OPTIONS. Furthermore I believe the response is missing some typical OPTIONS header parameters. This is not my area of expertise, just read the MDN to get it working...Here are the changes I did:
Added catch all path for OPTIONS requests
Removed OPTIONS method from all other `@app.route´ handlers
Added extra headers to
apply_cors
(this might have been redundant):