[Feature request] A more powerful custom origin calculation method depending on other headers

[fabis94]

[Feature request] A more powerful custom origin calculation method depending on other headers

[dougwilson]

I don't think that is feasable with CORS. Have you verified? Because either the Cookie header or the Authorization header would be included in the CORS OPTIONS request by the web browser, which is the point at which the Origin header would need to be responded to. This is because the pre-flight request (OPTIONS method) only contains a small subset of headers that are defined in the CORS spec.

[dougwilson]

So the way CORS itself works (unrelated to this module) is that it's a "double-opt-in" system. The idea is that the client has no idea if the web server supports CORS and so it needs a way to probe that. What they did was create a "pre-flight" request whenever the original request was not a "safe request" -- that is, if the request is not one of the "simple verbs" and/or it contains auth-like headers like Cookie, Authortization, etc. So when that is the case, the web browser will first make that "pre-flight request" which is the veb OPTIONS and includes none of the body content and headers from the original request, and that request is where your decision needs to happen on what the Access-Control-Allow-Origin and etc. headers contain. If it doesn't contain the Origin then the web browser will fail and never make the original request.

Your example wants to decide between two cases that are both "non-safe" and thus they would both use a pre-flight, at which point, it would not be possible to tell which is which case but you need to supply a Access-Control-Allow-Origin to get the original request to be made, of course.

I hope that makes sense.

[fabis94]

@dougwilson Am I understanding you correctly - you're skeptical cause not all headers will be available for checking in that newly proposed origin calculation callback?

If so, I still think it's good enough, cause you can at least check some headers. The most important ones are the authorization & cookie headers, so as long as those are there, that's already very helpful.

[dougwilson]

I'm saying that AFAIK neither of those exact headers would be available, so your solution wouldn't work no matter if this was added or not. I'm asking if you verified that or not.

[fabis94]

@dougwilson I haven't verified this, no, it was my assumption that you'd get these headers like you would with a normal request. With this new information coming to light, the feature request might not make any sense anymore

[fabis94]

It does make sense, thank you