arno/isso
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

make CORS middleware more generic to use

Browse Source
This commit is contained in:
Martin Zimmermann 2014-03-04 15:40:21 +01:00
parent 72c38c2312
commit c4b80ff702
3 changed files with 24 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
isso/__init__.py
View File

@ -182,7 +182,8 @@ def make_app(conf=None, threading=True, multiprocessing=False, uwsgi=False):
'/css': join(dirname(__file__), 'css/')})) '/css': join(dirname(__file__), 'css/')}))
wrapper.append(partial(wsgi.CORSMiddleware, wrapper.append(partial(wsgi.CORSMiddleware,
origin=origin(isso.conf.getiter("general", "host")))) origin=origin(isso.conf.getiter("general", "host")),
allowed=("Origin", "Content-Type"), exposed=("X-Set-Cookie", )))
wrapper.extend([wsgi.SubURI, ProxyFix]) wrapper.extend([wsgi.SubURI, ProxyFix])

14
isso/wsgi.py
View File

@ -60,19 +60,25 @@ class SubURI(object):
class CORSMiddleware(object): class CORSMiddleware(object):
"""Add Cross-origin resource sharing headers to every request.""" """Add Cross-origin resource sharing headers to every request."""
def __init__(self, app, origin): methods = ("HEAD", "GET", "POST", "PUT", "DELETE")
def __init__(self, app, origin, allowed=[], exposed=[]):
self.app = app self.app = app
self.origin = origin self.origin = origin
self.allowed = allowed
self.exposed = exposed
def __call__(self, environ, start_response): def __call__(self, environ, start_response):
def add_cors_headers(status, headers, exc_info=None): def add_cors_headers(status, headers, exc_info=None):
headers = Headers(headers) headers = Headers(headers)
headers.add("Access-Control-Allow-Origin", self.origin(environ)) headers.add("Access-Control-Allow-Origin", self.origin(environ))
headers.add("Access-Control-Allow-Headers", "Origin, Content-Type")
headers.add("Access-Control-Allow-Credentials", "true") headers.add("Access-Control-Allow-Credentials", "true")
headers.add("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE") headers.add("Access-Control-Allow-Methods", ", ".join(self.methods))
headers.add("Access-Control-Expose-Headers", "X-Set-Cookie") if self.allowed:
headers.add("Access-Control-Allow-Headers", ", ".join(self.allowed))
if self.exposed:
headers.add("Access-Control-Expose-Headers", ", ".join(self.exposed))
return start_response(status, headers.to_list(), exc_info) return start_response(status, headers.to_list(), exc_info)
if environ.get("REQUEST_METHOD") == "OPTIONS": if environ.get("REQUEST_METHOD") == "OPTIONS":

15
specs/test_cors.py
View File

@ -22,21 +22,23 @@ class CORSTest(unittest.TestCase):
def test_simple(self): def test_simple(self):
app = CORSMiddleware(hello_world, origin=origin([ app = CORSMiddleware(hello_world,
origin=origin([
"https://example.tld/", "https://example.tld/",
"http://example.tld/", "http://example.tld/",
"http://example.tld", "http://example.tld",
])) ]),
allowed=("Foo", "Bar"), exposed=("Spam", ))
client = Client(app, Response) client = Client(app, Response)
rv = client.get("/", headers={"ORIGIN": "https://example.tld"}) rv = client.get("/", headers={"ORIGIN": "https://example.tld"})
self.assertEqual(rv.headers["Access-Control-Allow-Origin"], "https://example.tld") self.assertEqual(rv.headers["Access-Control-Allow-Origin"], "https://example.tld")
self.assertEqual(rv.headers["Access-Control-Allow-Headers"], "Origin, Content-Type")
self.assertEqual(rv.headers["Access-Control-Allow-Credentials"], "true") self.assertEqual(rv.headers["Access-Control-Allow-Credentials"], "true")
self.assertEqual(rv.headers["Access-Control-Allow-Methods"], "GET, POST, PUT, DELETE") self.assertEqual(rv.headers["Access-Control-Allow-Methods"], "HEAD, GET, POST, PUT, DELETE")
self.assertEqual(rv.headers["Access-Control-Expose-Headers"], "X-Set-Cookie") self.assertEqual(rv.headers["Access-Control-Allow-Headers"], "Foo, Bar")
self.assertEqual(rv.headers["Access-Control-Expose-Headers"], "Spam")
a = client.get("/", headers={"ORIGIN": "http://example.tld"}) a = client.get("/", headers={"ORIGIN": "http://example.tld"})
self.assertEqual(a.headers["Access-Control-Allow-Origin"], "http://example.tld") self.assertEqual(a.headers["Access-Control-Allow-Origin"], "http://example.tld")
@ -50,7 +52,8 @@ class CORSTest(unittest.TestCase):
def test_preflight(self): def test_preflight(self):
app = CORSMiddleware(hello_world, origin=origin(["http://example.tld"])) app = CORSMiddleware(hello_world, origin=origin(["http://example.tld"]),
allowed=("Foo", ), exposed=("Bar", ))
client = Client(app, Response) client = Client(app, Response)
rv = client.open(method="OPTIONS", path="/", headers={"ORIGIN": "http://example.tld"}) rv = client.open(method="OPTIONS", path="/", headers={"ORIGIN": "http://example.tld"})