Add additional headers to remove when cors is disabled (#317)

apache · Jul 26, 2018 · c89afeb · c89afeb
1 parent 56673df
commit c89afeb
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/scripts/lua/cors.lua b/scripts/lua/cors.lua
@@ -44,6 +44,8 @@ function _M.replaceHeaders()
       ngx.header['Access-Control-Allow-Methods'] = nil
       ngx.header['Access-Control-Allow-Headers'] = nil
       ngx.header['Access-Control-Allow-Credentials'] = nil
+      ngx.header['Access-Control-Expose-Headers'] = nil
+      ngx.header['Access-Control-Max-Age'] = nil
     else
       ngx.header['Access-Control-Allow-Origin'] = ngx.var.cors_origins == 'true' and (ngx.var.http_origin or '*') or ngx.var.cors_origins
       ngx.header['Access-Control-Allow-Methods'] = ngx.var.cors_methods or 'GET, POST, PUT, DELETE, PATCH, HEAD, OPTIONS'