Commit 228ed00a authored by Ash McKenzie's avatar Ash McKenzie

Merge branch 'fix/expose_missing_headers' into 'master'

fix: add missing Access-Control-Expose-Headers values

Closes #194897

See merge request gitlab-org/gitlab!22838
parents 3029be8b f36a4d6d
......@@ -229,13 +229,15 @@ module Gitlab
# Allow access to GitLab API from other domains
config.middleware.insert_before Warden::Manager, Rack::Cors do
headers_to_expose = %w[Link X-Total X-Total-Pages X-Per-Page X-Page X-Next-Page X-Prev-Page X-Gitlab-Blob-Id X-Gitlab-Commit-Id X-Gitlab-Content-Sha256 X-Gitlab-Encoding X-Gitlab-File-Name X-Gitlab-File-Path X-Gitlab-Last-Commit-Id X-Gitlab-Ref X-Gitlab-Size]
allow do
origins Gitlab.config.gitlab.url
resource '/api/*',
credentials: true,
headers: :any,
methods: :any,
expose: %w[Link X-Total X-Total-Pages X-Per-Page X-Page X-Next-Page X-Prev-Page]
expose: headers_to_expose
end
# Cross-origin requests must not have the session cookie available
......@@ -245,7 +247,7 @@ module Gitlab
credentials: false,
headers: :any,
methods: :any,
expose: %w[Link X-Total X-Total-Pages X-Per-Page X-Page X-Next-Page X-Prev-Page]
expose: headers_to_expose
end
end
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment