search

jdesrosiers / silex-cors-provider

A silex service provider that adds CORS services to silex
MIT License
78 stars 25 forks source link

Access-Control-Expose-Headers should be comma, not space separated #35

Closed vrodic closed 7 years ago

vrodic commented 7 years ago

Hello,

According to Mozilla MDN here, https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Expose-Headers

Access-Control-Expose-Headers should be comma, not space separated. It also defaults to none, not to all.

We've seen this when testing with Angular 2 Client on Google Chrome. The Angular 2 client doesn't see the headers we've sent (Location for example) if the list of allowed headers is not comma separated.

You probably need to update your documentation and tests.

jdesrosiers commented 7 years ago

Thanks! You're right. I'll fix it up.

jdesrosiers commented 7 years ago

Done.