PreflightRequest check requset headers ignore case and ignore simple …

…request headers Signed-off-by: Norgerman <xyn0410@gmail.com>
aspnet · Sep 9, 2015 · 38728a6 · 38728a6
1 parent 2c14ac3
commit 38728a6
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 4 deletions.
diff --git a/src/Microsoft.AspNet.Cors.Core/CorsService.cs b/src/Microsoft.AspNet.Cors.Core/CorsService.cs
@@ -97,7 +97,8 @@ public virtual void EvaluatePreflightRequest(HttpContext context, CorsPolicy pol
 
             if (!policy.AllowAnyHeader &&
                 requestHeaders != null &&
-                !requestHeaders.All(header => policy.Headers.Contains(header, StringComparer.Ordinal)))
+                !requestHeaders.All(header => CorsConstants.SimpleRequestHeaders.Contains(header, StringComparer.OrdinalIgnoreCase) ||
+                                              policy.Headers.Contains(header, StringComparer.OrdinalIgnoreCase)))
             {
                 return;
             }

diff --git a/test/Microsoft.AspNet.Cors.Core.Test/CorsServiceTests.cs b/test/Microsoft.AspNet.Cors.Core.Test/CorsServiceTests.cs
@@ -397,7 +397,7 @@ public void EvaluatePolicy_PreflightRequest_HeadersRequested_AllowSomeHeaders_Re
                 method: "OPTIONS",
                 origin: "http://example.com",
                 accessControlRequestMethod: "PUT",
-                accessControlRequestHeaders: new[] { "Content-Type" });
+                accessControlRequestHeaders: new[] { "content-type", "accept" });
             var policy = new CorsPolicy();
             policy.Origins.Add(CorsConstants.AnyOrigin);
             policy.Methods.Add("*");
@@ -409,8 +409,8 @@ public void EvaluatePolicy_PreflightRequest_HeadersRequested_AllowSomeHeaders_Re
             var result = corsService.EvaluatePolicy(requestContext, policy);
 
             // Assert
-            Assert.Equal(1, result.AllowedHeaders.Count);
-            Assert.Contains("Content-Type", result.AllowedHeaders);
+            Assert.Equal(2, result.AllowedHeaders.Count);
+            Assert.Contains("Content-Type", result.AllowedHeaders, StringComparer.OrdinalIgnoreCase);
         }
 
         [Fact]