Automatic CORS preflight (added in 1.16.0) always returns header 'Access-Control-Allow-Origin': '*'. When using credentials, '*' is not accepted by browsers, and a specific allowed origin is needed instead.
When I define the options endpoint myself and try to return a specific origin, it appears that the automatic preflight takes precedence so the response still has '*'. I can't update above 1.15.0 because of this.
- If I specify my own
options response for an endpoint, that should be used instead of the automatic one.
- I should be able to turn off the automatic CORS preflight (completely and/or per-endpoint).
EDIT: there are 2 places when the Access-Control-* headers are relevant - OPTIONS request, and in responseHeaders on a GET response. To get CORS with credentials working, I had to make sure I returned the right allowed origin and other access control headers from both of those.
I forget whether I tested overriding the default CORS in both these places at once.
Automatic CORS preflight (added in 1.16.0) always returns header
'Access-Control-Allow-Origin': '*'. When using credentials,'*'is not accepted by browsers, and a specific allowed origin is needed instead.When I define the
optionsendpoint myself and try to return a specific origin, it appears that the automatic preflight takes precedence so the response still has'*'. I can't update above 1.15.0 because of this.optionsresponse for an endpoint, that should be used instead of the automatic one.EDIT: there are 2 places when the Access-Control-* headers are relevant - OPTIONS request, and in responseHeaders on a GET response. To get CORS with credentials working, I had to make sure I returned the right allowed origin and other access control headers from both of those.
I forget whether I tested overriding the default CORS in both these places at once.