mirror of
https://github.com/openziti/ziti.git
synced 2026-09-10 16:55:41 +00:00
Paul Lorenz
f1264086d4
- resolves zt-session tokens eagerly when the request context is created, so every request carrying one marks activity and gets session lifetime headers, regardless of endpoint - marks last activity in SecurityCtx.resolveZtSession once the session is loaded - adds SecurityTokenCtx.HasZtSessionHeader, a header-only check that does not parse bearer tokens - emits only session lifetime headers from the API wrappers and drops the unused session-error header branch, so a stale token on an anonymous endpoint stays silent as it did on 1.6.x - tests that requests to authenticated and anonymous endpoints with a zt-session mark activity, carry lifetime headers, and are reflected by current-api-session
48 lines
1.2 KiB
Go
48 lines
1.2 KiB
Go
/*
|
|
Copyright NetFoundry Inc.
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
https://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
*/
|
|
|
|
package api
|
|
|
|
import (
|
|
"net/http"
|
|
|
|
"github.com/gorilla/handlers"
|
|
"github.com/openziti/ziti/v2/common"
|
|
)
|
|
|
|
func WrapCorsHandler(innerHandler http.Handler) http.Handler {
|
|
corsOpts := []handlers.CORSOption{
|
|
handlers.AllowedOrigins([]string{"*"}),
|
|
handlers.OptionStatusCode(200),
|
|
handlers.AllowedHeaders([]string{
|
|
"content-type",
|
|
"accept",
|
|
"authorization",
|
|
common.ZtSessionHeader,
|
|
}),
|
|
handlers.AllowedMethods([]string{
|
|
http.MethodGet,
|
|
http.MethodHead,
|
|
http.MethodPost,
|
|
http.MethodPut,
|
|
http.MethodPatch,
|
|
http.MethodDelete}),
|
|
handlers.AllowCredentials(),
|
|
}
|
|
|
|
return handlers.CORS(corsOpts...)(innerHandler)
|
|
}
|