yield after setting headers about koa-cors HOT 6 CLOSED

Hi sorry the delay, I will check this issue this weekend. Thanks

from koa-cors.

No problem.

You should also change your wildcard support for origin.

Using an asterisk is not allowed as origin header following the specs however you can workaround by setting the origin header to the host header of the client. This should be the default behavior I suggest.

Am 16.05.2014 um 12:59 schrieb Everton Yoshitani [email protected]:

Hi sorry the delay, I will check this issue this weekend. Thanks

—
Reply to this email directly or view it on GitHub.

from koa-cors.

Hi @bodokaiser Thanks to bring this up and sorry for the delay got busy past weeks. So the first issue is fixed now it's moved to the bottom, if you can please confirm that this sorted out the issue for you.

Regarding the default behaviour for origin header, I'm not sure can you provide more info on that? I double checked the spec and I find the asterisk documented as an alternative for wildcard.

http://www.w3.org/TR/cors/#access-control-allow-origin-response-header

https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS#Access-Control-Allow-Origin

from koa-cors.

@evert0n sry I cannot test this right away but I think this should solve the problem.

Regarding the default behavior:

The string "*" cannot be used for a resource that supports credentials.

Source

This means that in case of using credentials (e.g. cookies, authorization headers, blabla) we cannot use a wildcard. However at least for development it sucks to 1) update your hosts file to fake the origin and to move your dev apps to port 80 or 443...

from koa-cors.

Thanks I changed a bit the behaviour of the default origin so it will give priority to the req.header.origin and fallback to * if not available. If that don't works for you, you can still code a function for the origin options and from there do whatever you need to set the right host.

from koa-cors.

Thanks I guess this covers all cases :)

I will replace my cors logic with koa-cors the upcoming days again. :)

Am 21.05.2014 um 16:52 schrieb Everton Yoshitani [email protected]:

Thanks I changed a bit the behaviour of the default origin so it will give priority to the req.header.origin and fallback to * if not available. If that don't works for you, you can still code a function for the origin options and from there do whatever you need to set the right host.

—
Reply to this email directly or view it on GitHub.

from koa-cors.