mirror of
https://github.com/discourse/discourse.git
synced 2025-06-24 02:55:39 +08:00
27227c9ece
Previously we would check the request for a matching CDN hostname before applying the `Access-Control-Allow-Origin` header. That logic requires the CDN to include its public-facing hostname in the `Host` header, which is not always the case. Since we are only running this `apply_cdn_headers` before_action on publicly-accessible asset routes, we can simplify things so that the `Access-Control-Allow-Origin: *` header is always included. That will make CDN config requirements much more relaxed. At the moment, this is primarily relevant to the HighlightJsController routes, which are loaded using native JS `type=module`. But in the near future, we plan to expand our use of `type=module` to more critical JS assets like translations and themes. Also drops the `Access-Control-Allow-Methods` header from these responses. That isn't needed for `GET` and `HEAD` requests.
34 lines
1.0 KiB
Ruby
34 lines
1.0 KiB
Ruby
# frozen_string_literal: true
|
|
|
|
RSpec.describe HighlightJsController do
|
|
it "works via the site URL" do
|
|
get HighlightJs.path
|
|
expect(response.status).to eq(200)
|
|
expect(response.body).to include("export default function")
|
|
expect(response.headers["Access-Control-Allow-Origin"]).to eq("*")
|
|
end
|
|
|
|
it "works via a CDN" do
|
|
cdn = "https://original-app-cdn.example.com"
|
|
set_cdn_url cdn
|
|
|
|
get "#{cdn}#{HighlightJs.path}"
|
|
expect(response.status).to eq(200)
|
|
expect(response.body).to include("export default function")
|
|
expect(response.headers["Access-Control-Allow-Origin"]).to eq("*")
|
|
end
|
|
|
|
it "works via a CDN when site has cors configuration" do
|
|
cdn = "https://original-app-cdn.example.com"
|
|
set_cdn_url cdn
|
|
|
|
global_setting :enable_cors, true
|
|
SiteSetting.cors_origins = "https://example.com"
|
|
|
|
get "#{cdn}#{HighlightJs.path}"
|
|
expect(response.status).to eq(200)
|
|
expect(response.body).to include("export default function")
|
|
expect(response.headers["Access-Control-Allow-Origin"]).to eq("*")
|
|
end
|
|
end
|