Better CORS support (#3)

allow unauthenticated OPTIONS, add default ACAH

src/api-umbrella/proxy/middleware/api_settings.lua

@@ -17,6 +17,13 @@ return function(api)
     deep_merge_overwrite_arrays(settings, api["settings"])
   end
 
+  -- Add some defaults for OPTIONS
+  -- See https://github.com/apinf/platform/issues/3531
+  local request_method = ngx.ctx.request_method
+  if(request_method == "OPTIONS") then
+    settings["disable_api_key"] = true
+  end
+
   -- See if there's any settings for a matching sub-url.
   if api["sub_settings"] then
     local request_method = ngx.ctx.request_method

src/api-umbrella/proxy/middleware/rewrite_response.lua

@@ -53,6 +53,15 @@ local function set_via_header()
   end
 end
 
+local function set_cors_headers()
+  local acah = ngx.header["Access-Control-Allow-Headers"]
+  if acah == "" or acah == nil then
+          ngx.header["Access-Control-Allow-Headers"] = "x-api-key"
+  else
+          ngx.header["Access-Control-Allow-Headers"] = acah .. ",x-api-key"
+  end
+end
+
 local function set_default_headers(settings)
   if settings["_default_response_headers"] then
     local existing_headers = ngx.resp.get_headers()
@@ -121,6 +130,8 @@ return function(settings)
   set_cache_header()
   set_via_header()
 
+  set_cors_headers()
+
   if settings then
     set_default_headers(settings)
     set_override_headers(settings)