1 -- TODO workaround, needs to be resolved in WebMCP's request.handler

2 if not request._route then

3 return

4 end

5

6 if request.get_module() == "oauth2" and request.get_view() == "session" then

7 local origin = request.get_header("Origin")

8 if origin then

9 request.add_header("Access-Control-Allow-Origin", origin)

10 end

11 request.add_header("Access-Control-Allow-Credentials", "true")

12 request.add_header("Access-Control-Max-Age", "0")

13 else

14 request.add_header("Access-Control-Allow-Origin", "*")

15 end

16

17 request.add_header("Access-Control-Allow-Headers", "Authorization")