m-lab / locate / 21512163100

Build # 21512163100

Build Type

push

github

Committed by web-flow

Commit Message

fix(handler): handle preflight CORS request (#248)

When we make a request with `Authorization` for m-lab/locate from
https://github.com/m-lab/mlab-speedtest/pull/81, the request itself stops
being a [simple request](https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CORS#simple_requests)
and becomes a [preflighted request](https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CORS#preflighted_requests).

This happens because the `Authorization` header is not in the set
of headers allowed for simple requests. As such, a browser will issue
a `OPTIONS *` request first to check whether the server would accept
such a request or not.

In turn, this causes a `403` when trying to invoke m-lab/locate in
https://github.com/m-lab/mlab-speedtest/pull/81.

To address this issue, we extend the set of allowed methods to also
include `OPTIONS` and we handle `OPTIONS *` by returning `200`. We
return `200` because of https://stackoverflow.com/a/46028619.

Coverage Stats

2389 of 2906 relevant lines covered (82.21%)

6.06 hits per line

Source File

Press 'n' to go to next uncovered line, 'b' for previous

Source Not Available