Custom header test failing

[nolanlawson]

In the PouchDB test suite, the "custom header" test is failing.

I would like to just whitelist all X-* headers, since this is apparently the correct CORS behavior (CouchDB and our proxy both do that), but unfortunately it seems to be an open unresolved issue in Corser: agrueneberg/Corser#2

[nolanlawson]

You can only repro this by NOT using a proxy, btw.

[nolanlawson]

A dumb solution that I can confirm works is to just add X-Custom to the list of allowed headers, but this is a dumb fix because it only works for that particular test.

[nolanlawson]

I don't see a good way to fix this, and corser doesn't seem to be recently maintained. Maybe switch to https://github.com/expressjs/cors instead?

[nolanlawson]

Easiest way to repro:

 curl -v 'http://localhost:6984/test_http/?_nonce=1441075737857' -X OPTIONS -H 'Access-Control-Request-Method: GET' -H 'Origin: http://localhost:8000' -H 'Accept-Encoding: gzip, deflate, sdch' -H 'Accept-Language: en-US,en;q=0.8' -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36' -H 'Accept: */*' -H 'Referer: http://localhost:8000/tests/integration/?grep=custom%20header' -H 'Connection: keep-alive' -H 'Access-Control-Request-Headers: accept, x-custom' --compressed

Does not send back Access-Control-Allow-Headers, whereas this one does:

curl -v 'http://localhost:6984/test_http/?_nonce=1441075737857' -X OPTIONS -H 'Access-Control-Request-Method: GET' -H 'Origin: http://localhost:8000' -H 'Accept-Encoding: gzip, deflate, sdch' -H 'Accept-Language: en-US,en;q=0.8' -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36' -H 'Accept: */*' -H 'Referer: http://localhost:8000/tests/integration/?grep=custom%20header' -H 'Connection: keep-alive' -H 'Access-Control-Request-Headers: accept' --compressed

[marten-de-vries]

An alternative lib is ok with me it that's the only fix. The main thing would be integrating it with the config again, I imagine (but the current corser implementation probably gives a good idea how to do that.)

[nolanlawson]

This bug can still be repro'd, although for whatever reason it's no longer the case that the PouchDB test suite is failing.