m-lab / locate / 21485597235

82%

main: 82%

Build Type

Pull #248

github

Committed by bassosimone

Commit Message

fix(handler): handle preflight CORS request

When we make a request with `Authorization` for m-lab/locate from
https://github.com/m-lab/mlab-speedtest/pull/81, the request itself stops
being a [simple request](https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CORS#simple_requests)
and becomes a [preflighted request](https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CORS#preflighted_requests).

This happens because the `Authorization` header is not in the set
of headers allowed for simple requests. As such, a browser will issue
a `OPTIONS *` request first to check whether the server would accept
such a request or not.

In turn, this causes a `403` when trying to invoke m-lab/locate in
https://github.com/m-lab/mlab-speedtest/pull/81.

To address this issue, we extend the set of allowed methods to also
include `OPTIONS` and we handle `OPTIONS *` by returning `204`.

Pull Request Pull Request #248: fix(handler): handle preflight CORS request

Run Details

5 of 7 new or added lines in 1 file covered. (71.43%)

13 existing lines in 1 file now uncovered.

2386 of 2903 relevant lines covered (82.19%)

6.05 hits per line