Running Datasette with --cors doesn't allow Authorization header to be passed in

[jameslittle230]

Hi Simon! I'm really enjoying Datasette so far. Wanted to ask about a small incompatibility with this plugin, and offer to submit a PR with some guidance.

Running Datasette with the --cors command line option sets the Access-Control-Allow-Origin header, as expected. However, when I use this plugin and pass in an Authorization header, my web browsers block the request because Datasette's response does not include a Access-Control-Allow-Headers header with a value that includes Authorization. This means the authorized request is blocked by the browser.

Is there a way that this plugin, when running in a Datasette instance instantiated with the --cors flag, could set the pages to return the Access-Control-Allow-Headers header as well?

Thanks!
James

[n0rdlicht]

Second this, ran across this exact issue today. Any way to enable Access-Control-Allow-Headers either with the --cors flag or via the datasette-cors plugin?

[simonw]

Thanks for this, I'm going to merge your PR and release it as part of Datasette 0.59.

[simonw]

Datasette 0.59 is now out and implements this change.