Credentialed CORS standard requests should not respond with wildcard origins about starlette HOT 5 CLOSED

Okay, I’ll put a PR in at some point today when I have time.

from starlette.

Sounds good.

Also, on the subject of the Vary: Origin header, it looks like we should be setting that header for specified origins as well.

From https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#The_HTTP_response_headers

If the server specifies a single origin rather than the "*" wildcard, then the server should also include Origin in the Vary response header — to indicate to clients that server responses will differ based on the value of the Origin request header.

from starlette.

Gotcha, yup. Setting the Vary header on standard responses is complicated by the fact that it may already be set, so you need to make so to add-or-include "Origin" in the header value. I guess we should probably start by only considering the no credentialed "wildcard" origins part of this.

from starlette.

Here's the current idea I'm playing with..

async def send(self, message, send=None, request_headers=None):
    ...
    ...
    origin = request_headers.get("origin")
    cookie = request_headers.get("cookie")
    vary = request_headers.get("vary")

    if cookie and self.allow_all_origins:
        headers["Vary"] = f"{vary}, Origin" if vary else "Origin"
        self.simple_headers["Access-Control-Allow-Origin"] = origin
    elif not self.allow_all_origins and self.is_allowed_origin(origin=origin):
        headers["Access-Control-Allow-Origin"] = origin

from starlette.

Cool. Possibly use has_cookie = "cookie" in request_headers just to avoid any Falsey-evaluating edge cases. Also, vary: origin ought to get set in any case except "self.allow_all_origins".

from starlette.