1.1 --- /dev/null	Thu Jan 01 00:00:00 1970 +0000
     1.2 +++ b/app/main/http_options.lua	Sun Jul 15 14:07:29 2018 +0200
     1.3 @@ -0,0 +1,17 @@
     1.4 +-- TODO workaround, needs to be resolved in WebMCP's request.handler
     1.5 +if not request._route then
     1.6 +  return
     1.7 +end
     1.8 +
     1.9 +if request.get_module() == "oauth2" and request.get_view() == "session" then
    1.10 +  local origin = request.get_header("Origin")
    1.11 +  if origin then
    1.12 +    request.add_header("Access-Control-Allow-Origin", origin)
    1.13 +  end
    1.14 +  request.add_header("Access-Control-Allow-Credentials", "true")
    1.15 +  request.add_header("Access-Control-Max-Age", "0")
    1.16 +else
    1.17 +  request.add_header("Access-Control-Allow-Origin", "*")
    1.18 +end
    1.19 +    
    1.20 +request.add_header("Access-Control-Allow-Headers", "Authorization")