Merge pull request #35 from IIIF/CORS_Options

Fixing OPTIONS request CORS

.ebextensions/nginx/conf.d/elasticbeanstalk/00_application.conf

@@ -100,10 +100,10 @@ location ^~ /api/ {
     location ~ \.json$ {
 		 include conf.d/elasticbeanstalk/subfiles/iiif-website.conf;
 		 proxy_hide_header 'Content-Type';
-		 add_header 'Access-Control-Allow-Origin' '*';
 		 add_header 'Content-Type' '$jsonmimetype';
          add_header 'Cache-Control' 'public, no-transform, max-age=300';
          add_header "X-UA-Compatible" "IE=Edge,chrome=1";
+         add_header 'Access-Control-Allow-Origin' '*';
     }
     location ~ ontology\.xml$ {
 		 include conf.d/elasticbeanstalk/subfiles/iiif-website.conf;

.ebextensions/nginx/conf.d/elasticbeanstalk/subfiles/iiif-website.conf

@@ -1,8 +1,10 @@
 proxy_set_header Authorization '';
 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
 proxy_set_header X-Real-IP $remote_addr;
+proxy_hide_header Access-Control-Request-Method;
+proxy_set_header Access-Control-Request-Method GET;
 proxy_hide_header x-amz-id-2;
 proxy_hide_header x-amz-request-id;
 proxy_intercept_errors on;
 proxy_pass http://iiif-website.s3-website-us-east-1.amazonaws.com;
-
+proxy_hide_header 'Access-Control-Allow-Origin';

tests/TestCORS.py

@@ -8,6 +8,24 @@ class TestCORS(unittest.TestCase):
     def setUp(self):
         self.baseurl = os.environ["baseurl"]
 
+    def test_options_cors(self):
+        url = "%s/%s" % (self.baseurl,'api/cookbook/recipe/0068-newspaper/newspaper_issue_1-manifest.json')    
+        headers = {
+            "Origin": "https://example.com",
+            "Accept": "*/*",
+            "Accept-Encoding": "gzip, deflate, br",
+            "Connection": "keep-alive",
+            "User-Agent": "HTTPie/3.2.1"
+        }
+
+        response = requests.options(url, allow_redirects=False, headers=headers)
+        code = response.status_code
+        self.assertEqual(code,204, 'Failed to get newspaper json file for CORS testing. Got response %s from URL %s\n%s' % (code, url, response.text))
+
+        # Check CORS headers
+        self.assertTrue('Access-Control-Allow-Origin' in response.headers, 'Missing Access-Control-Allow-Origin header from %s' % url)
+        self.assertEqual(response.headers['Access-Control-Allow-Origin'],"*", 'Expected header Access-Control-Allow-Origin:* but was Access-Control-Allow-Origin:%s' % (response.headers['Access-Control-Allow-Origin']))
+
     def test_xml_cors(self):
         url = "%s/%s" % (self.baseurl, 'api/cookbook/recipe/0068-newspaper/newspaper_issue_1-alto_p1.xml')