Merge pull request http-party#150 from MichalCz/master

Cors with additional headers

Author: indexzero

bin/http-server

@@ -24,7 +24,8 @@ if (argv.h || argv.help) {
     '  -i           Display autoIndex [true]',
     '  -e --ext     Default file extension if none supplied [none]',
     '  -s --silent  Suppress log messages from output',
-    '  --cors       Enable CORS via the "Access-Control-Allow-Origin" header',
+    '  --cors[=headers]   Enable CORS via the "Access-Control-Allow-Origin" header',
+    '                     Optionally provide CORS headers list separated by commas',
     '  -o [path]    Open browser window after starting the server',
     '  -c           Cache time (max-age) in seconds [3600], e.g. -c10 for 10 seconds.',
     '               To disable caching, use -c-1.',
@@ -103,6 +104,9 @@ function listen(port) {
 
   if (argv.cors) {
     options.cors = true;
+    if (typeof argv.cors === 'string') {
+      options.corsHeaders = argv.cors;
+    }
   }
 
   if (ssl) {

lib/http-server.js

@@ -67,8 +67,13 @@ function HttpServer(options) {
   if (options.cors) {
     this.headers['Access-Control-Allow-Origin'] = '*';
     this.headers['Access-Control-Allow-Headers'] = 'Origin, X-Requested-With, Content-Type, Accept, Range';
-
-    before.push(corser.create());
+    if (options.corsHeaders) {
+      options.corsHeaders.split(/\s*,\s*/)
+          .forEach(function (h) { this.headers['Access-Control-Allow-Headers'] += ', ' + h; }, this);
+    }
+    before.push(corser.create(options.corsHeaders ? {
+      requestHeaders: this.headers['Access-Control-Allow-Headers'].split(/\s*,\s*/)
+    } : null));
   }
 
   if (options.robots) {

test/http-server-test.js

@@ -129,7 +129,8 @@ vows.describe('http-server').addBatch({
     topic: function () {
       var server = httpServer.createServer({
         root: root,
-        cors: true
+        cors: true,
+        corsHeaders: 'X-Test'
       });
       server.listen(8082);
       this.callback(null, server);
@@ -148,6 +149,9 @@ vows.describe('http-server').addBatch({
       },
       'status code should be 204': function (err, res) {
         assert.equal(res.statusCode, 204);
+      },
+      'response Access-Control-Allow-Headers should contain X-Test': function (err, res) {
+        assert.ok(res.headers['access-control-allow-headers'].split(/\s*,\s*/g).indexOf('X-Test') >= 0, 204);
       }
     }
   }