hubcio opened a new pull request, #3646: URL: https://github.com/apache/iggy/pull/3646
The listener deserialized [http.cors] (shipped with enabled = true) but never read it: no CorsLayer was installed, so browser clients were blocked and every cors field in the config was silently dead. Port the legacy server's mapping: empty origin list = tower-http default, leading "*" = any origin, otherwise an explicit allow-list; entries are trimmed, blank ones dropped, and an unknown method fails the boot loudly instead of passing through as a custom token. Unlike the legacy port, configs tower-http rejects by panicking (a "*" origin past the first position, or allow_credentials combined with a wildcard origin, header, or expose list) fail as InvalidConfiguration, and cors is validated before bind so a bad config never prints the "started" log or opens the socket. The layer is outermost because server-ng authenticates per route: a preflight OPTIONS carries no Authorization and matches no method route, so it must be answered before dispatch. Also expose x-iggy-view instead of the "" placeholder so browser clients can read the view header cross-origin. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
