Merge pull request #106 from artlogic/cors-header

CORS - configurable Access-Control-Allow-Headers

README.md

@@ -139,6 +139,16 @@ For HTTP methods such as DELETE, you may want Drakov to return them in the appro
 
 `drakov -f "../com/foo/contracts/*.md" --method DELETE --method OPTIONS`
 
+## Allow Headers Header
+
+For HTTP headers such as Authorization, you may want Drakov to return them in the appropriate methods allow header. You can do this using the `--header` argument
+
+`drakov -f "../com/foo/contracts/*.md" --header Authorization`
+
+`drakov -f "../com/foo/contracts/*.md" --header Authorization --header X-Csrf-Token`
+
+Drakov includes many headers by default: `Origin, X-Requested-With, Content-Type, Accept` when CORS is enabled.
+
 
 ## Using as a Node.js module
 

lib/arguments/arguments.js

@@ -34,6 +34,9 @@ module.exports = {
     method: {
         description: 'Add method to Access-Control-Allow-Methods response header'
     },
+    header: {
+        description: 'Add header to Access-Control-Allow-Headers response header'
+    },
     public: {
         description: 'Allow external requests',
         default: false

lib/middleware/index.js

@@ -9,7 +9,7 @@ var bootstrapMiddleware = function(app, argv) {
     if (argv.staticPaths) {
         staticMiddleware.setupRoutes(app, argv.staticPaths, argv.pathDelimiter);
     }
-    app.use(responseUtils.corsHeaders(argv.disableCORS));
+    app.use(responseUtils.corsHeaders(argv.disableCORS, argv.header));
     app.use(responseUtils.delayedResponse(argv.delay));
     app.use(responseUtils.allowMethods(argv.method));
 };

lib/middleware/response.js

@@ -16,12 +16,18 @@ exports.drakovHeaders = function(req, res, next) {
     next();
 };
 
-exports.corsHeaders = function(disableCORS) {
+exports.corsHeaders = function(disableCORS, allowHeaders) {
     return function(req, res, next) {
         if (!disableCORS) {
             res.set('Access-Control-Allow-Origin', req.headers.origin || '*');
             res.set('Access-Control-Allow-Credentials', 'true');
-            res.set('Access-Control-Allow-Headers', 'Origin, X-Requested-With, Content-Type, Accept');
+
+            if (allowHeaders) {
+                var headers = Array.isArray(allowHeaders) ? allowHeaders.join(',') : allowHeaders;
+                res.set('Access-Control-Allow-Headers', 'Origin, X-Requested-With, Content-Type, Accept, ' + headers);
+            } else {
+                res.set('Access-Control-Allow-Headers', 'Origin, X-Requested-With, Content-Type, Accept');
+            }
         }
         next();
     };

test/api/headers-allow-headers-test.js

@@ -0,0 +1,26 @@
+var helper = require('../lib');
+var request = helper.getRequest();
+
+describe('HEADERS', function(){
+
+    before(function (done) {
+        helper.drakov.run({sourceFiles: 'test/example/md/headers.md', header: ['Authorization']}, done);
+    });
+
+    after(function (done) {
+        helper.drakov.stop(done);
+    });
+
+    describe('/headers', function(){
+
+        describe('DELETE', function(){
+            it('should respond with HTTP 200 and Access-Control-Allow-Headers', function(done){
+                request.delete('/headers')
+                .expect(200)
+                .expect('Access-Control-Allow-Headers', /Authorization/)
+                .end(helper.endCb(done));
+            });
+        });
+    });
+
+});