diff --git a/cmd/api/middleware.go b/cmd/api/middleware.go
index 68b2f97..d09e7ad 100644
--- a/cmd/api/middleware.go
+++ b/cmd/api/middleware.go
@@ -173,7 +173,9 @@ func (app *application) requirePermissions(code string, next http.HandlerFunc) h
func (app *application) enableCORS(next http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
- w.Header().Set("Vary", "Origin")
+ w.Header().Add("Vary", "Origin")
+
+ w.Header().Add("Vary", "Access-Control-Request-Method")
origin := r.Header.Get("Origin")
@@ -181,6 +183,14 @@ func (app *application) enableCORS(next http.Handler) http.Handler {
for i := range app.config.cors.trustedOrigins {
if origin == app.config.cors.trustedOrigins[i] {
w.Header().Set("Access-Control-Allow-Origin", origin)
+
+ if r.Method == http.MethodOptions && r.Header.Get("Access-Control-Request-Method") != "" {
+ w.Header().Set("Access-Control-Allow-Methods", "OPTIONS, PUT, PATCH, DELETE")
+ w.Header().Set("Access-Control-Allow-Headers", "Authorization, Content-Type")
+
+ w.WriteHeader(http.StatusOK)
+ return
+ }
break
}
}
diff --git a/cmd/examples/cors/preflight/main.go b/cmd/examples/cors/preflight/main.go
new file mode 100644
index 0000000..8566fdd
--- /dev/null
+++ b/cmd/examples/cors/preflight/main.go
@@ -0,0 +1,54 @@
+package main
+
+import (
+ "flag"
+ "log"
+ "net/http"
+)
+
+const html = `
+
+
+
+
+
+
+ Preflight CORS
+
+
+
+`
+
+func main() {
+ addr := flag.String("addr", ":9000", "Server address")
+ flag.Parse()
+
+ log.Printf("starting server on %s", *addr)
+
+ err := http.ListenAndServe(*addr, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+ w.Write([]byte(html))
+ }))
+ log.Fatal(err)
+}