feat: Add configurable CORS Headers #3114
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Signed-off-by: Josiah Evans <josiah.evans@lunit.io>
josiah-lunit
force-pushed
the
feature/add-config-headers
branch
from
bc8c846 to
726a55e
Compare
nabokihms
approved these changes
Dec 28, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Overview
The CORS enforced endpoints only allow the
Authorizationheader by default, and this behavior is not configurable. For some environments, it is desirable to allow configuration of which headers should be accepted (e.g. when using Swagger UI with a Dex IDP, which for instance inserts ax-requested-withheader to the CORS preflight check).What this PR does / why we need it
This PR allows the
AllowedHeadersfor CORS endpoints to be configurable, so that the host can decide if headers should be rejected or not. By default, theAuthorizationheader will be accepted to not interfere with any existing setups of Dex if noallowedHeadersare defined in theconfig.yamlfile.Does this PR introduce a user-facing change?
Yes