From 5d083bc22c75b479c2f0da02ed5eea1b4c440518 Mon Sep 17 00:00:00 2001 From: alalamav <2132122+alalamav@users.noreply.github.com> Date: Thu, 22 Aug 2019 13:10:03 -0400 Subject: [PATCH] Synthesize DigitalOcean API CORS preflight responses (#477) --- src/server_manager/electron_app/index.ts | 20 ++++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-) diff --git a/src/server_manager/electron_app/index.ts b/src/server_manager/electron_app/index.ts index 4f2dab4a..aa4a40e2 100644 --- a/src/server_manager/electron_app/index.ts +++ b/src/server_manager/electron_app/index.ts @@ -150,13 +150,29 @@ function getWebAppUrl() { // Digital Ocean stopped sending 'Acces-Control-Allow-Origin' headers in some API responses // (i.e. v2/droplets). As a workaround, intercept DO API requests and preemptively inject the -// header to allow our origin. +// header to allow our origin. Additionally, some OPTIONS requests return 403. Modify the response +// status code and inject CORS response headers. function workaroundDigitalOceanApiCors() { const headersFilter = {urls: ['https://api.digitalocean.com/*']}; electron.session.defaultSession.webRequest.onHeadersReceived( // tslint:disable-next-line:no-any headersFilter, (details: any, callback: Function) => { - details.responseHeaders['access-control-allow-origin'] = ['outline://web_app']; + if (details.method === 'OPTIONS') { + details.responseHeaders['access-control-allow-origin'] = ['outline://web_app']; + if (details.statusCode === 403) { + details.statusCode = 200; + details.statusLine = 'HTTP/1.1 200'; + details.responseHeaders['status'] = ['200']; + details.responseHeaders['access-control-allow-headers'] = + [details.headers['Access-Control-Request-Headers']]; + details.responseHeaders['access-control-allow-credentials'] = ['true']; + details.responseHeaders['access-control-allow-methods'] = + ['GET, POST, PUT, PATCH, DELETE, OPTIONS']; + details.responseHeaders['access-control-expose-headers'] = + ['RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset, Total, Link']; + details.responseHeaders['access-control-max-age'] = ['86400']; + } + } callback(details); }); }