change how origin header is treated
Now check whether the origin is in allowed_origins table, and if not check allow_all_origins config parameter. While here: - add are_cors_preflight_requests_available - if true then preflight requests are available (default false)
This commit is contained in:
@@ -1002,18 +1002,21 @@ public:
|
||||
// if the limit is reached then the http status 503 Service Unavailable is returned
|
||||
size_t request_queue_job_limit;
|
||||
|
||||
// whether or not all origins are allowed in cors requests
|
||||
// default: false;
|
||||
// if false then we check allowed_cors_origins table to check whether the origin is available (origin is sent in Origin header),
|
||||
// if allow_all_cors_origins is false and allowed_cors_origins is empty then by default we do not allow cors requests
|
||||
// (but you can still allow it in your function/controller by overriding IsCorsOriginAvailable(...) method)
|
||||
bool allow_all_cors_origins;
|
||||
|
||||
// list of allowed origins in cors requests
|
||||
// can be set per controller in a method: virtual bool FunctionBase::IsCorsOriginAvailable(const std::wstring & origin_url)
|
||||
// used only if allow_all_cors_origins is false
|
||||
// can be set per controller in a method: virtual bool FunctionBase::IsOriginAvailable(const std::wstring & origin_url)
|
||||
// default: empty
|
||||
std::vector<std::wstring> allowed_cors_origins;
|
||||
std::vector<std::wstring> allowed_origins;
|
||||
|
||||
// whether or not all origins are allowed if allowed_origins is empty
|
||||
// default: true
|
||||
// this is true by default because Origin header is sent not only in cors requests
|
||||
// (you can still allow it in your function/controller by overriding IsOriginAvailable(...) method)
|
||||
bool allow_all_origins;
|
||||
|
||||
// whether or not cors preflight requests are available
|
||||
// https://developer.mozilla.org/en-US/docs/Glossary/Preflight_request
|
||||
// default: false
|
||||
bool are_cors_preflight_requests_available;
|
||||
|
||||
// list of additional headers sent in Access-Control-Expose-Headers header
|
||||
// can be set per controller in a method: virtual void FunctionBase::AddAccessControlExposeHeadersHeader()
|
||||
|
Reference in New Issue
Block a user