search

pact-foundation / pact-stub-server

Standalone pact stub server
MIT License
75 stars 19 forks source link

Access-Control-Allow-Headers allows only authorization and Content-Type with --cors enabled #29

Closed dariobanfi closed 5 years ago

dariobanfi commented 5 years ago

Hi,

I'm trying to test an interaction, where the consumer sends a custom header X-Authorization. The problem is that if I start the stub-server, with the --cors option, the server hardcodes: Access-Control-Allow-Headers: authorization, Content-Type ( see https://github.com/uglyog/pact-stub-server/blob/master/src/server.rs#L75)

This causes the OPTIONS request performed by the browser to fail, because X-Authorization is missing.

Wouldn't it make sense to hardcode instead: Access-Control-Allow-Headers: * ?

dariobanfi commented 5 years ago

Or at least returning back non-standard headers from the request in the Access-Control-Allow-Headers response. Let me know if a merge request is welcome.

uglyog commented 5 years ago

PR's are always welcome. I am unsure as to why those headers were chosen, but * makes sense to me.