Access-Control-Allow-Headers in API

[24unix]

• Gitea version (or commit ref): v1.12 and HEAD branch
• Git version: 2.20.1
• Operating system: Debian Buster 10.4
• Database (use [x]):
  • PostgreSQL
  • MySQL
  • MSSQL
  • SQLite
• Can you reproduce the bug at https://try.gitea.io:
  • Yes (provide example URL)
  • No: Seems broken, throws 500 error
  • Not relevant
• Log gist:

Description

I already postet some information here:
#6408

I try to give a summary.

I want to access the list of all commits in a given repo in a Vue app using axios.

My Gitea server works fine, accessing the info via curl works, even in Chrome I get the expected headers (see screenshot), but the cors settings prevent the Javascript, or especially axios to access the data.

Here are some background infos:
https://stackoverflow.com/questions/37897523/axios-get-access-to-response-header-fields

So, I need to tell Gitea to send X-Total in the Access-Control-Allow-Headers, I already glimpsed through the code, tried to change it myself, only to find out later that it was the part related to the general http stuff, not the API.

That is part of my code:

async fetchData() { this.isLoading = true; axios.get(https://git.24unix.net:3000/api/v1/repos/24unix.net/yyyy/commits?page=${this.currentPage}&limit=10`,
{
headers: {
Authorization: 'token ' + "bfebd3123cyyyyyyyyyyyyyyy34abe46f1a",
}
})
.then((response) => {
`

Response headers just contain the Content-Type.

Chrome receives the relevant headers: