CORS preflight - Access-Control-Request-Headers -> Access-Control-Allow-Headers

lib/httpServer.js

@@ -16,16 +16,19 @@ module.exports = function(provider, logger) {
         // do whatever we need to in order to respond to this request.
 
         var headers = {
-          "Access-Control-Allow-Headers": "Origin, X-Requested-With, Content-Type, Accept, User-Agent",
-          "Access-Control-Allow-Origin": "*",
-          "Access-Control-Allow-Methods": "*"
+          "Access-Control-Allow-Origin": "*"
         };
 
         switch (method) {
           case "OPTIONS":
-            headers["Content-Type"] = "text/plain";
-            response.writeHead(200, headers);
-            response.end("");
+            if (request.headers.hasOwnProperty("access-control-request-headers")) {
+              headers["Access-Control-Allow-Headers"] = request.headers["access-control-request-headers"];
+              headers["Vary"] = "Access-Control-Request-Headers";
+            }
+            headers["Access-Control-Allow-Methods"] = "POST";
+            headers["Content-Length"] = 0;
+            response.writeHead(204, headers);
+            response.end();
             break;
           case "POST":
             // console.log("Request coming in:", body);
@@ -67,12 +70,8 @@ module.exports = function(provider, logger) {
 
             break;
           default:
-            response.writeHead(400, {
-              "Access-Control-Allow-Headers": "Origin, X-Requested-With, Content-Type, Accept, User-Agent",
-              "Access-Control-Allow-Origin": "*",
-              "Access-Control-Allow-Methods": "*",
-              "Content-Type": "text/plain"
-            });
+            headers["Content-Type"] = "text/plain";
+            response.writeHead(400, headers);
             response.end("400 Bad Request");
             break;
         }

test/cors.js

@@ -0,0 +1,59 @@
+const assert = require("assert");
+const Ganache = require("../index.js");
+const request = require("request");
+const pify = require("pify");
+
+const customRequestHeader = "X-PINGOTHER";
+
+function test(host, port) {
+  describe("CORS", () => {
+    it("should request headers equals to response headers in a preflight request", (done) => {
+      let req = request.options(
+        {
+          url: "http://" + host + ":" + port,
+          headers: {
+            "Access-Control-Request-Headers": customRequestHeader
+          }
+        },
+        function(error, response) {
+          if (error) {
+            return done(error);
+          }
+
+          let allowHeader = "";
+
+          if (response.headers.hasOwnProperty("access-control-allow-headers")) {
+            allowHeader = response.headers["access-control-allow-headers"];
+          }
+
+          assert.strictEqual(
+            allowHeader,
+            customRequestHeader,
+            "Access-Control-Allow-Headers should be equals to Access-Control-Request-Headers"
+          );
+
+          done();
+        }
+      );
+
+      req.destroy();
+    });
+  });
+}
+
+describe("HTTP Server:", function() {
+  const host = "localhost";
+  const port = 12345;
+  let server;
+
+  before("Initialize Ganache server", async function() {
+    server = Ganache.server();
+    await pify(server.listen)(port);
+  });
+
+  after("Shutdown server", async function() {
+    await pify(server.close)();
+  });
+
+  test(host, port);
+});