Added: Allow required headers

samply · Feb 8, 2024 · 33097d1 · 33097d1
1 parent 621a781
commit 33097d1
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 1 deletion.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -94,3 +94,4 @@ and this project adheres to [Semantic Versioning](http://semver.org/).
 - New email if authentication script for DataSHIELD has changed
 - Explorer URL in CORS
 - Oauth2 Resource Server configuration
+- Allow required headers
diff --git a/src/main/java/de/samply/security/SecurityConfiguration.java b/src/main/java/de/samply/security/SecurityConfiguration.java
@@ -127,7 +127,7 @@ CorsConfigurationSource corsConfigurationSource() {
         CorsConfiguration configuration = new CorsConfiguration();
         configuration.setAllowedOrigins(Arrays.asList(frontendConfiguration.getBaseUrl(), explorerUrl));
         configuration.setAllowedMethods(Arrays.asList("GET", "POST", "OPTIONS"));
-        //configuration.setAllowedHeaders(Arrays.asList("Origin", "Content-Type", "Accept", "Authorization")); // Allow required headers
+        configuration.setAllowedHeaders(Arrays.asList("Origin", "Content-Type", "Accept", "Authorization")); // Allow required headers
         configuration.setAllowCredentials(true); // Allow credentials
         configuration.setExposedHeaders(Arrays.asList(HttpHeaders.ACCESS_CONTROL_ALLOW_ORIGIN, HttpHeaders.ACCESS_CONTROL_ALLOW_CREDENTIALS)); // Expose required headers
         UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();