Send Access-Control-Max-Age header

[dbkr]

Description:

If synapse sent an Access-Control-Max-Age header with its CORS responses, user agents could cache the CORS response and wouldn't need to do an OPTIONS request for every single /sync request. Even caching for 60s could massively reduce the number of requests on a busy account, but it would probably make sense for it to be a config option.

Context: all C/S API requests need to be preflighted if they send the access token using the Authorization header (even GET requests) because Authorization is not in the standard set of allowed headers.

[timokoesters]

I just experimented with this in Conduit. It seems like the Access-Control-Max-Age header only allows caching if the query parameters of the request are the same too. This rarely happens with /sync because of the since parameter.

[richvdh]

Related reading: https://github.com/matrix-org/matrix-doc/issues/785

[timokoesters]

I think this can be fixed while we add sliding syncs. I mentioned it here but did not get a response yet: matrix-org/matrix-spec-proposals#3575 (comment)