From 9187aa669d1453b909da3f72019d813bd60a5cd5 Mon Sep 17 00:00:00 2001 From: Alastair Houghton Date: Mon, 5 Oct 2020 14:53:48 +0100 Subject: [PATCH] fix: allow Authorization header when doing CORS The Authorization header needs to be allowed when doing CORS because otherwise /userinfo can't work. It isn't one of the headers explicitly allowed by default by Gorilla, so we have to call handlers.AllowedHeaders() to specify it. Issues: #1532 Signed-off-by: Alastair Houghton --- server/server.go | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/server/server.go b/server/server.go index 481cc58d..c7d416fa 100644 --- a/server/server.go +++ b/server/server.go @@ -294,8 +294,14 @@ func newServer(ctx context.Context, c Config, rotationStrategy rotationStrategy) handleWithCORS := func(p string, h http.HandlerFunc) { var handler http.Handler = h if len(c.AllowedOrigins) > 0 { - corsOption := handlers.AllowedOrigins(c.AllowedOrigins) - handler = handlers.CORS(corsOption)(handler) + allowedHeaders := []string{ + "Authorization", + } + cors := handlers.CORS( + handlers.AllowedOrigins(c.AllowedOrigins), + handlers.AllowedHeaders(allowedHeaders), + ) + handler = cors(handler) } r.Handle(path.Join(issuerURL.Path, p), instrumentHandlerCounter(p, handler)) }