# HG changeset patch
# User Matthew Wild <mwild1@gmail.com>
# Date 1568211031 -3600
# Node ID 4ff2f14f9ac7b37f8b9d720e4ad26d95d3d5bfd0
# Parent  b2e7b07f8b747161174b0c5a1d2e111b3264d644
mod_http: Add support for configuring CORS Access-Control-Allow-Credentials

diff -r b2e7b07f8b74 -r 4ff2f14f9ac7 plugins/mod_http.lua
--- a/plugins/mod_http.lua	Tue Sep 10 18:17:13 2019 +0200
+++ b/plugins/mod_http.lua	Wed Sep 11 15:10:31 2019 +0100
@@ -26,6 +26,7 @@
 -- CORS settigs
 local opt_methods = module:get_option_set("access_control_allow_methods", { "GET", "OPTIONS" });
 local opt_headers = module:get_option_set("access_control_allow_headers", { "Content-Type" });
+local opt_credentials = module:get_option_boolean("access_control_allow_credentials", false);
 local opt_max_age = module:get_option_number("access_control_max_age", 2 * 60 * 60);
 
 local function get_http_event(host, app_path, key)
@@ -89,11 +90,14 @@
 	return "http://disabled.invalid/";
 end
 
-local function apply_cors_headers(response, methods, headers, max_age, origin)
+local function apply_cors_headers(response, methods, headers, max_age, allow_credentials, origin)
 	response.headers.access_control_allow_methods = tostring(methods);
 	response.headers.access_control_allow_headers = tostring(headers);
 	response.headers.access_control_max_age = tostring(max_age)
 	response.headers.access_control_allow_origin = origin or "*";
+	if allow_credentials then
+		response.headers.access_control_allow_credentials = "true";
+	end
 end
 
 function module.add_host(module)
@@ -119,7 +123,7 @@
 
 		local function cors_handler(event_data)
 			local request, response = event_data.request, event_data.response;
-			apply_cors_headers(response, app_methods, opt_headers, opt_max_age, request.headers.origin);
+			apply_cors_headers(response, app_methods, opt_headers, opt_max_age, opt_credentials, request.headers.origin);
 		end
 
 		local function options_handler(event_data)