Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 14, 05:15 UTC
admin: Only write most CORS headers in OPTIONS requests
Matthew Holt committed
Dec 23, 2019 at 12:46 UTC
16ee985c22c2fcfa2e108dcc7d3e8ce184fd95ed
1 file changed
+6
-4
admin.go
+6
-4
@@ -50,7 +50,7 @@ type AdminConfig struct {
50
51
// The address to which the admin endpoint's listener should
52
// bind itself. Can be any single network address that can be
53
- // parsed by Caddy.
53
+ // parsed by Caddy. Default: localhost:2019
54
Listen string `json:"listen,omitempty"`
55
56
// If true, CORS headers will be emitted, and requests to the
@@ -282,10 +282,12 @@ func (h adminHandler) serveHTTP(w http.ResponseWriter, r *http.Request) {
282
return
283
}
284
285
+ if r.Method == http.MethodOptions {
286
+ w.Header().Set("Access-Control-Allow-Methods", "OPTIONS, GET, POST, PUT, PATCH, DELETE")
287
+ w.Header().Set("Access-Control-Allow-Headers", "Content-Type, Content-Length, Cache-Control")
288
+ w.Header().Set("Access-Control-Allow-Credentials", "true")
289
+ }
290
w.Header().Set("Access-Control-Allow-Origin", origin)
286
- w.Header().Set("Access-Control-Allow-Methods", "OPTIONS, GET, POST, PUT, PATCH, DELETE")
287
- w.Header().Set("Access-Control-Allow-Headers", "Content-Type, Content-Length, Cache-Control")
288
- w.Header().Set("Access-Control-Allow-Credentials", "true")
291
}
292
293
// TODO: authentication & authorization, if configured