diff options
| author | Alexey Efimov <xeno@ydb.tech> | 2024-11-11 11:31:12 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2024-11-11 17:31:12 +0700 |
| commit | 7b9c7e3f6223eb40fa69c7415b78f76b94024e24 (patch) | |
| tree | e9472fda12fc2854c3fc6d990110831af62b0c7a | |
| parent | 8c8ed072fe6358b3733bf8e3484ed5dfb7c07ee9 (diff) | |
| download | ydb-7b9c7e3f6223eb40fa69c7415b78f76b94024e24.tar.gz | |
add cors headers to oidc proxy (#11450)
| -rw-r--r-- | ydb/mvp/oidc_proxy/oidc_proxy_ut.cpp | 4 | ||||
| -rw-r--r-- | ydb/mvp/oidc_proxy/openid_connect.cpp | 6 |
2 files changed, 6 insertions, 4 deletions
diff --git a/ydb/mvp/oidc_proxy/oidc_proxy_ut.cpp b/ydb/mvp/oidc_proxy/oidc_proxy_ut.cpp index a052aab7944..68ff53dccb2 100644 --- a/ydb/mvp/oidc_proxy/oidc_proxy_ut.cpp +++ b/ydb/mvp/oidc_proxy/oidc_proxy_ut.cpp @@ -560,10 +560,10 @@ Y_UNIT_TEST_SUITE(Mvp) { UNIT_ASSERT_STRINGS_EQUAL("true", headers.Get(accessControlAllowCredentials)); UNIT_ASSERT(headers.Has(accessControlAllowHeaders)); - UNIT_ASSERT_STRINGS_EQUAL("Content-Type,Authorization,Origin,Accept", headers.Get(accessControlAllowHeaders)); + UNIT_ASSERT_STRINGS_EQUAL("Content-Type,Authorization,Origin,Accept,X-Trace-Verbosity,X-Want-Trace,traceparent", headers.Get(accessControlAllowHeaders)); UNIT_ASSERT(headers.Has(accessControlAllowMethods)); - UNIT_ASSERT_STRINGS_EQUAL("OPTIONS, GET, POST", headers.Get(accessControlAllowMethods)); + UNIT_ASSERT_STRINGS_EQUAL("OPTIONS,GET,POST,PUT,DELETE", headers.Get(accessControlAllowMethods)); } bool IsAjaxRequest() const override { diff --git a/ydb/mvp/oidc_proxy/openid_connect.cpp b/ydb/mvp/oidc_proxy/openid_connect.cpp index fbc7714c597..498f44a1735 100644 --- a/ydb/mvp/oidc_proxy/openid_connect.cpp +++ b/ydb/mvp/oidc_proxy/openid_connect.cpp @@ -50,8 +50,10 @@ void SetCORS(const NHttp::THttpIncomingRequestPtr& request, NHttp::THeadersBuild } headers->Set("Access-Control-Allow-Origin", origin); headers->Set("Access-Control-Allow-Credentials", "true"); - headers->Set("Access-Control-Allow-Headers", "Content-Type,Authorization,Origin,Accept"); - headers->Set("Access-Control-Allow-Methods", "OPTIONS, GET, POST"); + headers->Set("Access-Control-Allow-Headers", "Content-Type,Authorization,Origin,Accept,X-Trace-Verbosity,X-Want-Trace,traceparent"); + headers->Set("Access-Control-Expose-Headers", "traceresponse,X-Worker-Name"); + headers->Set("Access-Control-Allow-Methods", "OPTIONS,GET,POST,PUT,DELETE"); + headers->Set("Allow", "OPTIONS,GET,POST,PUT,DELETE"); } TString HmacSHA256(TStringBuf key, TStringBuf data) { |