fix: JS caching via Access-Control-Expose-Headers (#8984)
This fix safelists additional headers allowing JS running on websites to read them when IPFS resource is downloaded via Fetch API. These headers provide metadata necessary for making smart caching decisions when IPFS resources are downloaded via Service Worker or a similar middleware on the edge. (cherry picked from commit 650bc246ab4a7c2a11a207e3bf9d74c07d190eb7)
Marcin Rataj committed
May 19, 2022 at 20:11 UTC
4449909b2da690d3677903fc0b1797c1ad00275b
2 files changed
+14
-2
core/corehttp/gateway.go
+3
@@ -84,9 +84,12 @@ func GatewayOption(writable bool, paths ...string) ServeOption {
84
85
headers[ACEHeadersName] = cleanHeaderSet(
86
append([]string{
87
+ "Content-Length",
88
"Content-Range",
89
"X-Chunked-Output",
90
"X-Stream-Output",
91
+ "X-Ipfs-Path",
92
+ "X-Ipfs-Roots",
93
}, headers[ACEHeadersName]...))
94
95
var gateway http.Handler = newGatewayHandler(GatewayConfig{
test/sharness/t0112-gateway-cors.sh
+11
-2
@@ -26,7 +26,10 @@ test_expect_success "GET response for Gateway resource looks good" '
26
grep "< Access-Control-Allow-Origin: \*" curl_output &&
27
grep "< Access-Control-Allow-Methods: GET" curl_output &&
28
grep "< Access-Control-Allow-Headers: Range" curl_output &&
29
- grep "< Access-Control-Expose-Headers: Content-Range" curl_output
29
+ grep "< Access-Control-Expose-Headers: Content-Range" curl_output &&
30
+ grep "< Access-Control-Expose-Headers: Content-Length" curl_output &&
31
+ grep "< Access-Control-Expose-Headers: X-Ipfs-Path" curl_output &&
32
+ grep "< Access-Control-Expose-Headers: X-Ipfs-Roots" curl_output
33
'
34
35
# HTTP OPTIONS Request
@@ -40,7 +43,10 @@ test_expect_success "OPTIONS response for Gateway resource looks good" '
43
grep "< Access-Control-Allow-Origin: \*" curl_output &&
44
grep "< Access-Control-Allow-Methods: GET" curl_output &&
45
grep "< Access-Control-Allow-Headers: Range" curl_output &&
43
- grep "< Access-Control-Expose-Headers: Content-Range" curl_output
46
+ grep "< Access-Control-Expose-Headers: Content-Range" curl_output &&
47
+ grep "< Access-Control-Expose-Headers: Content-Length" curl_output &&
48
+ grep "< Access-Control-Expose-Headers: X-Ipfs-Path" curl_output &&
49
+ grep "< Access-Control-Expose-Headers: X-Ipfs-Roots" curl_output
50
'
51
52
test_kill_ipfs_daemon
@@ -63,6 +69,9 @@ test_expect_success "Access-Control-Allow-Headers extends" '
69
grep "< Access-Control-Allow-Headers: Range" curl_output &&
70
grep "< Access-Control-Allow-Headers: X-Custom1" curl_output &&
71
grep "< Access-Control-Expose-Headers: Content-Range" curl_output &&
72
+ grep "< Access-Control-Expose-Headers: Content-Length" curl_output &&
73
+ grep "< Access-Control-Expose-Headers: X-Ipfs-Path" curl_output &&
74
+ grep "< Access-Control-Expose-Headers: X-Ipfs-Roots" curl_output &&
75
grep "< Access-Control-Expose-Headers: X-Custom2" curl_output
76
'
77