Add Authorization to default CORS headers in configuration

trellis-ldp · Apr 2, 2019 · 053c4c9 · 053c4c9
1 parent 476fd2a
commit 053c4c9
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 3 deletions.
diff --git a/components/app/README.md b/components/app/README.md
@@ -100,8 +100,8 @@ cors:
 | enabled | false | Whether [CORS](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS) is enabled |
 | allowOrigin | "*" | A list of allowed origins |
 | allowMethods | "PUT", "DELETE", "PATCH", "GET", "HEAD", "OPTIONS", "POST" | A list of allowed methods |
-| allowHeaders | "Content-Type", "Link", "Accept", "Accept-Datetime", "Prefer", "Want-Digest", "Slug", "Digest" | A list of allowed request headers |
-| exposeHeaders | "Content-Type", "Link", "Memento-Datetime", "Preference-Applied", "Location", "Accept-Patch", "Accept-Post", "Digest", "Accept-Ranges", "ETag", "Vary" | A list of allowed response headers |
+| allowHeaders | "Content-Type", "Link", "Accept", "Accept-Datetime", "Prefer", "Slug", "Authorization"  | A list of allowed request headers |
+| exposeHeaders | "Content-Type", "Link", "Memento-Datetime", "Preference-Applied", "Location", "Accept-Patch", "Accept-Post", "Accept-Ranges", "ETag", "Vary" | A list of allowed response headers |
 | maxAge | 180 | The maximum age (in seconds) of pre-flight messages |
 | allowCredentials | true | Whether the actual request can be made with credentials |
 

diff --git a/components/app/src/main/java/org/trellisldp/app/config/CORSConfiguration.java b/components/app/src/main/java/org/trellisldp/app/config/CORSConfiguration.java
@@ -32,7 +32,7 @@ public class CORSConfiguration {
             "GET", "HEAD", "OPTIONS", "POST");
 
     private List<String> allowHeaders = asList("Content-Type", "Link", "Accept",
-            "Accept-Datetime", "Prefer", "Slug", "Origin");
+            "Accept-Datetime", "Authorization", "Prefer", "Slug", "Origin");
 
     private List<String> exposeHeaders = asList("Content-Type", "Link",
             "Memento-Datetime", "Preference-Applied", "Location",