From 5a2f968d7a868fcfed2c67055ada88dd7a8db06b Mon Sep 17 00:00:00 2001
From: vpl <vpl@vpl.me>
Date: Mon, 2 Sep 2019 21:13:12 +0200
Subject: [PATCH] Set correct response headers, status code

---
 src/util.rs | 32 ++++++++++++++++++++++----------
 1 file changed, 22 insertions(+), 10 deletions(-)

diff --git a/src/util.rs b/src/util.rs
index 6792fdc5..a3548fcb 100644
--- a/src/util.rs
+++ b/src/util.rs
@@ -4,7 +4,7 @@
 use rocket::fairing::{Fairing, Info, Kind};
 use rocket::response::{self, Responder};
 use rocket::{Request, Response};
-use rocket::http::{Header, ContentType, Method};
+use rocket::http::{Header, HeaderMap, ContentType, Method, Status};
 use std::io::Cursor;
 
 pub struct AppHeaders();
@@ -33,9 +33,17 @@ impl Fairing for AppHeaders {
     }
 }
 
-
 pub struct CORS();
 
+impl CORS {
+    fn get_header(headers: &HeaderMap, name: &str) -> String {
+        match headers.get_one(name) {
+            Some(h) => h.to_string(),
+            _ => "".to_string(),
+        }
+    }
+}
+
 impl Fairing for CORS {
     fn info(&self) -> Info {
         Info {
@@ -45,21 +53,25 @@ impl Fairing for CORS {
     }
 
     fn on_response(&self, request: &Request, response: &mut Response) {
-        // We need to explictly get the Origin header for Access-Control-Allow-Origin
-        let origin = match request.headers().get_one("Origin") {
-            Some(h) => h.to_string(),
-            _ => "".to_string(),
-        };
+        let req_headers = request.headers();
+
+        // We need to explicitly get the Origin header for Access-Control-Allow-Origin
+        let req_allow_origin = CORS::get_header(&req_headers, "Origin");
+
+        let req_allow_headers = CORS::get_header(&req_headers, "Access-Control-Request-Headers");
+
+        let req_allow_methods =CORS::get_header(&req_headers,"Access-Control-Request-Methods");
 
         if request.method() == Method::Options || response.content_type() == Some(ContentType::JSON) {
             // Requests with credentials need explicit values since they do not allow wildcards.
-            response.set_header(Header::new("Access-Control-Allow-Origin", origin));
-            response.set_header(Header::new("Access-Control-Allow-Methods", "GET, HEAD, POST, PUT, DELETE, CONNECT, OPTIONS, TRACE, PATCH"));
-            response.set_header(Header::new("Access-Control-Allow-Headers", "*, Authorization"));
+            response.set_header(Header::new("Access-Control-Allow-Origin", req_allow_origin));
+            response.set_header(Header::new("Access-Control-Allow-Methods", req_allow_methods));
+            response.set_header(Header::new("Access-Control-Allow-Headers", req_allow_headers));
             response.set_header(Header::new("Access-Control-Allow-Credentials", "true"));
         }
 
         if request.method() == Method::Options {
+            response.set_status(Status::Ok);
             response.set_header(ContentType::Plain);
             response.set_sized_body(Cursor::new(""));
         }