adding options to the supported request types (#513)

clay · Feb 14, 2018 · fd355d5 · fd355d5
1 parent 19cea31
commit fd355d5
Show file tree

Hide file tree

Showing 3 changed files with 3 additions and 3 deletions.
diff --git a/lib/auth.js b/lib/auth.js
@@ -428,7 +428,7 @@ function compileTemplate(filename) {
  */
 function protectRoutes(site) {
   return function (req, res, next) {
-    if (module.exports.isProtectedRoute(req)) { // allow mocking of these for testing
+    if (req.method !== 'OPTIONS' && module.exports.isProtectedRoute(req)) { // allow mocking of these for testing
       module.exports.isAuthenticated(site)(req, res, next);
     } else {
       next();

diff --git a/lib/routes.js b/lib/routes.js
@@ -19,7 +19,7 @@ const _ = require('lodash'),
   plugins = require('./plugins'),
   cors = {
     origins: '*',
-    methods: ['GET', 'POST', 'PUT', 'DELETE'].join(','),
+    methods: ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS'].join(','),
     headers: ['Accept', 'Accept-Encoding', 'Authorization', 'Content-Type', 'Host', 'Referer', 'Origin', 'User-Agent',
       'X-Forwarded-For', 'X-Forwarded-Host', 'X-Forwarded-Proto'].join(',')
   };

diff --git a/lib/routes.test.js b/lib/routes.test.js
@@ -58,7 +58,7 @@ describe(_.startCase(filename), function () {
 
       test({method: 'OPTIONS', headers: {}}, res);
 
-      sinon.assert.calledWith(spy, 'Access-Control-Allow-Methods', 'GET,POST,PUT,DELETE');
+      sinon.assert.calledWith(spy, 'Access-Control-Allow-Methods', 'GET,POST,PUT,DELETE,OPTIONS');
       sinon.assert.calledWith(spy, 'Access-Control-Allow-Headers', sinon.match.string);
     });
   });