cartodb4/Windshaft-cartodb
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

adding Authorization to Access-Control-Allow-Headers

Browse Source
This commit is contained in:
Simon Martín
2019-01-10 16:56:07 +01:00
parent ff27e6744e
commit 644b4232ca
6 changed files with 32 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
lib/cartodb/api/middlewares/cors.js
View File

@@ -5,7 +5,8 @@ module.exports = function cors () {
const headers = [
'X-Requested-With',
'X-Prototype-Version',
'X-CSRF-Token'
'X-CSRF-Token',
'Authorization'
];
if (req.method === 'OPTIONS') {

2
test/acceptance/ported/attributes.js
View File

@@ -36,7 +36,7 @@ describe('attributes', function() {
function checkCORSHeaders(res) {
assert.equal(
res.headers['access-control-allow-headers'],
'X-Requested-With, X-Prototype-Version, X-CSRF-Token'
'X-Requested-With, X-Prototype-Version, X-CSRF-Token, Authorization'
);
assert.equal(res.headers['access-control-allow-origin'], '*');
}

12
test/acceptance/ported/multilayer.js
View File

@@ -25,8 +25,11 @@ describe('multilayer', function() {
var IMAGE_EQUALS_TOLERANCE_PER_MIL = 20;
function checkCORSHeaders(res) {
assert.equal(res.headers['access-control-allow-headers'], 'X-Requested-With, X-Prototype-Version, X-CSRF-Token');
assert.equal(res.headers['access-control-allow-origin'], '*');
assert.equal(
res.headers['access-control-allow-headers'],
'X-Requested-With, X-Prototype-Version, X-CSRF-Token, Authorization'
);
assert.equal(res.headers['access-control-allow-origin'], '*');
}
// See https://github.com/Vizzuality/Windshaft/issues/70
@@ -1027,7 +1030,8 @@ describe('multilayer', function() {
//
////////////////////////////////////////////////////////////////////
it("get'ing options on layergroup should return CORS headers", function(done){
it("geting options on layergroup should return CORS headers", function(done){
const allowHeaders = 'X-Requested-With, X-Prototype-Version, X-CSRF-Token, Authorization, Content-Type';
assert.response(server, {
url: '/database/windshaft_test/layergroup',
method: 'OPTIONS'
@@ -1035,7 +1039,7 @@ describe('multilayer', function() {
status: 200,
// TODO: use checkCORSHeaders() function
headers: {
'Access-Control-Allow-Headers': 'X-Requested-With, X-Prototype-Version, X-CSRF-Token, Content-Type',
'Access-Control-Allow-Headers': allowHeaders,
'Access-Control-Allow-Origin': '*'
}
}, function() { done(); });

7
test/acceptance/ported/raster.js
View File

@@ -18,8 +18,11 @@ describe('raster', function() {
});
function checkCORSHeaders(res) {
assert.equal(res.headers['access-control-allow-headers'], 'X-Requested-With, X-Prototype-Version, X-CSRF-Token');
assert.equal(res.headers['access-control-allow-origin'], '*');
assert.equal(
res.headers['access-control-allow-headers'],
'X-Requested-With, X-Prototype-Version, X-CSRF-Token, Authorization'
);
assert.equal(res.headers['access-control-allow-origin'], '*');
}
var IMAGE_EQUALS_TOLERANCE_PER_MIL = 2;

7
test/acceptance/ported/torque.js
View File

@@ -28,8 +28,11 @@ describe('torque', function() {
});
function checkCORSHeaders(res) {
assert.equal(res.headers['access-control-allow-headers'], 'X-Requested-With, X-Prototype-Version, X-CSRF-Token');
assert.equal(res.headers['access-control-allow-origin'], '*');
assert.equal(
res.headers['access-control-allow-headers'],
'X-Requested-With, X-Prototype-Version, X-CSRF-Token, Authorization'
);
assert.equal(res.headers['access-control-allow-origin'], '*');
}
it("missing required property from torque layer", function(done) {

21
test/acceptance/templates.js
View File

@@ -307,16 +307,17 @@ describe('template_api', function() {
assert.response(server, post_request, {}, function(res) { next(null, res); });
},
function testCORS() {
assert.response(server, {
url: '/api/v1/map/named/acceptance1',
method: 'OPTIONS'
},{
status: 200,
headers: {
'Access-Control-Allow-Headers': 'X-Requested-With, X-Prototype-Version, X-CSRF-Token, Content-Type',
'Access-Control-Allow-Origin': '*'
}
}, function() { done(); });
const allowHeaders = 'X-Requested-With, X-Prototype-Version, X-CSRF-Token, Authorization, Content-Type';
assert.response(server, {
url: '/api/v1/map/named/acceptance1',
method: 'OPTIONS'
},{
status: 200,
headers: {
'Access-Control-Allow-Headers': allowHeaders,
'Access-Control-Allow-Origin': '*'
}
}, function() { done(); });
});
});