Browse Source
admin: Only write most CORS headers in OPTIONS requests
master
Matthew Holt
5 years ago
No known key found for this signature in database
GPG Key ID: 2A349DD577D586A5
1 changed files with
6 additions and
4 deletions
-
admin.go
|
|
@ -50,7 +50,7 @@ type AdminConfig struct { |
|
|
|
|
|
|
|
// The address to which the admin endpoint's listener should
|
|
|
|
// bind itself. Can be any single network address that can be
|
|
|
|
// parsed by Caddy.
|
|
|
|
// parsed by Caddy. Default: localhost:2019
|
|
|
|
Listen string `json:"listen,omitempty"` |
|
|
|
|
|
|
|
// If true, CORS headers will be emitted, and requests to the
|
|
|
@ -282,11 +282,13 @@ func (h adminHandler) serveHTTP(w http.ResponseWriter, r *http.Request) { |
|
|
|
return |
|
|
|
} |
|
|
|
|
|
|
|
w.Header().Set("Access-Control-Allow-Origin", origin) |
|
|
|
if r.Method == http.MethodOptions { |
|
|
|
w.Header().Set("Access-Control-Allow-Methods", "OPTIONS, GET, POST, PUT, PATCH, DELETE") |
|
|
|
w.Header().Set("Access-Control-Allow-Headers", "Content-Type, Content-Length, Cache-Control") |
|
|
|
w.Header().Set("Access-Control-Allow-Credentials", "true") |
|
|
|
} |
|
|
|
w.Header().Set("Access-Control-Allow-Origin", origin) |
|
|
|
} |
|
|
|
|
|
|
|
// TODO: authentication & authorization, if configured
|
|
|
|
|
|
|
|