telenordigital / goconnect Goto Github PK

https://github.com/telenordigital/goconnect/blob/master/mux.go#L39

It's not right to set a context value of type Session when normally it's a *Session. For OPTIONS requests there is no authorization so it doesn't make sense to set this value at all.

The <path>/profile endpoint will most likely be called by something async and sometimes the API/Auth server is on another domain meaning we need CORS. Add the usual CORS headers, ie

• Access-Control-Allow-Origin with the correct origin
• Access-Control-Allow-Methods with GET
• Access-Control-Allow-Credentials to true

We need to be able to handle a user cancelling the login flow as well as the login having an error.

Async calls use an OPTIONS preflight which they ask the server for permission to perform operations. During the preflight they do not send any authorize cookies, meaning they will fail the authorize call every time. Do not authorize calls with OPTIONS method.