search

tuupola / cors-middleware

PSR-7 and PSR-15 CORS middleware
MIT License
132 stars 16 forks source link

Concatenate exposed headers with comma only (see #40) #44

Closed tuupola closed 4 years ago

tuupola commented 4 years ago

Apparently Edge cannot handle spaces between header values either. https://developer.microsoft.com/en-us/microsoft-edge/platform/issues/12046299/

With example code:

$app->add(new Tuupola\Middleware\CorsMiddleware([
    "headers.expose" => ["content-length", "etag", "x-foo"],
]));

Current behaviour (1.1.0): 

$ curl --include http://0.0.0.0:8080  \
       --request PUT \
       --include \
       --header "Origin: http://www.example.com"

HTTP/1.1 200 OK
Access-Control-Allow-Origin: http://www.example.com
Vary: Origin
Access-Control-Expose-Headers: content-length, etag, x-foo

After applying this PR:

$ curl --include http://0.0.0.0:8080  \
       --request PUT \
       --include \
       --header "Origin: http://www.example.com"

HTTP/1.1 200 OK
Access-Control-Allow-Origin: http://www.example.com
Vary: Origin
Access-Control-Expose-Headers: content-length,etag,x-foo