Cors allowed headers do not include "Authorization" which is the default headers used with OAuth.

[chicco785]

Could you please add "Authorization" in the list of Cors allowed headers?

fiware-orion/src/lib/rest/HttpHeaders.h

Line 68 in 0dc7718

#define CORS_ALLOWED_HEADERS HTTP_CONTENT_TYPE ", " HTTP_FIWARE_SERVICE ", " HTTP_FIWARE_SERVICEPATH ", " HTTP_NGSIV2_ATTRSFORMAT ", " HTTP_FIWARE_CORRELATOR ", " HTTP_X_FORWARDED_FOR ", " HTTP_X_REAL_IP ", " HTTP_X_AUTH_TOKEN

[fgalan]

If you create the pull request for adding it, we can include it in the next release (soon to be frozen ;)

Is this the only point that need to be touched? Please check also documentation.

Finally, don't forget to add the corresponding entry to CHANGES_NEXT_RELEASE file, please.

Thanks!

[fgalan]

Btw, could you provide a little more context about the usage? I mean, in which case (architecture, etc.) are you using Orion with a system requiring CORS.

Thanks again!

[chicco785]

If you create the pull request for adding it, we can include it in the next release (soon to be frozen ;)

Is this the only point that need to be touched? Please check also documentation.

Finally, don't forget to add the corresponding entry to CHANGES_NEXT_RELEASE file, please.

Thanks!

Not a C developer. Said that, if it's just about adding that to the list, I can do, more complex if I need to develop a test case :)

[chicco785]

Btw, could you provide a little more context about the usage? I mean, in which case (architecture, etc.) are you using Orion with a system requiring CORS.

Thanks again!

We have an admin interface, now in front of Orion, we recently added a new authz proxy based on envoy, which by default pass all headers, so the issue popped up.

[fgalan]

Not a C developer. Said that, if it's just about adding that to the list, I can do, more complex if I need to develop a test case :)

Do a PR without the test so we can check if something break ;)

Next, maybe just adapting (copy-paste-modify) some of the tests in https://github.com/telefonicaid/fiware-orion/tree/master/test/functionalTest/cases/0501_cors would suffice. Please have a look.

[fgalan]

Fixed by PR #4251