-
Notifications
You must be signed in to change notification settings - Fork 1.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
fix(cors): emptyStatusCode not being taken into account for OPTIONS requests #4024
fix(cors): emptyStatusCode not being taken into account for OPTIONS requests #4024
Conversation
@hueniverse I just stumbled upon this issue when upgrading to v19 - could you please have a look? |
Hmm, this might not be a safe thing to do: https://stackoverflow.com/a/58794243/248062. |
@kanongil I can also change this to always return |
Ah, this is a bit tricky actually. You issue pertains to the However, when setting the Whether it should always return |
@kanongil How can I configure this as a global route config? |
new Hapi.Server({
routes: {
response: {
emptyStatusCode: 200
}
}
}); |
@kanongil Thanks, that works like a charm! I'll still leave this PR open for @hueniverse to have a look at. |
It looks like kong also went through this. In short, it sounds like the spec doesn't technically care but browser implementations do care or have cared in the past. MDN docs used to recommend serving a 200, but now they recommend a 204. Kong used to serve a 204, was patched to serve a 200, and today has an open issue to move back to 204. Kong/kong#4008 I propose we stick with the 204 default, but create a separate option |
This has been hanging around for a while, and I don't think this PR is going to land as-is. But the contribution is much appreciated, and helped move the conversation about this issue forward. There are still some ideas and open questions above, so I am going to close this and move it to an issue for further discussion. |
Here it is: #4165 |
With #3919 the default status code for empty responses changed from
200
to204
while still giving the user the ability to override this behaviour by using theemptyStatusCode
response setting. This setting however isn't being taken into account when using CORS and OPTIONS requests. This pull request fixes this glitch.