search

go-chi / cors

CORS net/http middleware for Go
MIT License
334 stars 32 forks source link

Custom header with undercore is been normilize to a header without it #14

Closed ocalvet closed 2 years ago

ocalvet commented 4 years ago

When I configure the allow headers to the following:

AllowedHeaders:   []string{"Accept", "Authorization", "Content-Type", "X-CSRF-Token", "contact_id"},

Then I send a request from my react client using the contact_id header on the request I get the following error in the debug log:

Preflight aborted: headers '[Contactid]' not allowed

When I check the code it looks like parseHeaderList function in the utils.go file is removing the underscores from the header list.

Why is this the default behavior?

Ariel-dono commented 4 years ago

https://httpwg.org/specs/rfc7230.html#rule.token.separators

Ariel-dono commented 4 years ago

https://github.com/rs/cors/pull/103

ted-marozzi commented 2 years ago

This should be fixed now for those from the future

pkieltyka commented 2 years ago

Thanks for the fix Ted