m-lab / locate / 21486791881

82%

main: 82%

Pull #248

github

fix(handler): handle preflight CORS request

When we make a request with `Authorization` for m-lab/locate from
https://github.com/m-lab/mlab-speedtest/pull/81, the request itself stops
being a [simple request](https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CORS#simple_requests)
and becomes a [preflighted request](https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CORS#preflighted_requests).

This happens because the `Authorization` header is not in the set
of headers allowed for simple requests. As such, a browser will issue
a `OPTIONS *` request first to check whether the server would accept
such a request or not.

In turn, this causes a `403` when trying to invoke m-lab/locate in
https://github.com/m-lab/mlab-speedtest/pull/81.

To address this issue, we extend the set of allowed methods to also
include `OPTIONS` and we handle `OPTIONS *` by returning `200`. We
return `200` because of https://stackoverflow.com/a/46028619.

10 of 10 new or added lines in 1 file covered. (100.0%)

2389 of 2906 relevant lines covered (82.21%)

6.05 hits per line