{"action":"created","issue":{"url":"https://api.github.com/repos/may-day/wsgicors/issues/11","labels_url":"https://api.github.com/repos/may-day/wsgicors/issues/11/labels{/name}","comments_url":"https://api.github.com/repos/may-day/wsgicors/issues/11/comments","events_url":"https://api.github.com/repos/may-day/wsgicors/issues/11/events","html_url":"https://github.com/may-day/wsgicors/issues/11","id":97399699,"number":11,"title":"OPTIONS requests not passed on","user":{"login":"MattSANU","id":5325824,"avatar_url":"https://avatars.githubusercontent.com/u/5325824?v=3","gravatar_id":"","url":"https://api.github.com/users/MattSANU","html_url":"https://github.com/MattSANU","followers_url":"https://api.github.com/users/MattSANU/followers","following_url":"https://api.github.com/users/MattSANU/following{/other_user}","gists_url":"https://api.github.com/users/MattSANU/gists{/gist_id}","starred_url":"https://api.github.com/users/MattSANU/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/MattSANU/subscriptions","organizations_url":"https://api.github.com/users/MattSANU/orgs","repos_url":"https://api.github.com/users/MattSANU/repos","events_url":"https://api.github.com/users/MattSANU/events{/privacy}","received_events_url":"https://api.github.com/users/MattSANU/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-07-27T07:00:18Z","updated_at":"2015-07-29T10:58:27Z","closed_at":null,"body":"Not all OPTIONS requests are CORS preflight requests, but the middleware currently responds to all OPTIONS requests itself; it never passes an OPTIONS request on to the next app/middleware in the chain. This prevents me from writing a later filter that responds to non-CORS OPTIONS requests with an 'Allow:' header listing the request methods I support.\r\n\r\nFirstly, would you accept a PR to fix this issue?\r\n\r\nAlso, should the code pass on all OPTIONS requests, then decorate them with CORS headers as appropriate?\r\nOr should it decide whether the OPTIONS request is CORS or not, and handle the request itself if it's CORS, but pass it on if it's not CORS?\r\n\r\nI don't understand whether an HTTP request can be both a CORS preflight request *and* an attempt to discover what request methods the server actually supports. Are these two possibilities exclusive?\r\n\r\nIn other words, would it be meaningful to respond with both an Access-Control-Allow-Methods header *and* an Allow header?"},"comment":{"url":"https://api.github.com/repos/may-day/wsgicors/issues/comments/125919299","html_url":"https://github.com/may-day/wsgicors/issues/11#issuecomment-125919299","issue_url":"https://api.github.com/repos/may-day/wsgicors/issues/11","id":125919299,"user":{"login":"MattSANU","id":5325824,"avatar_url":"https://avatars.githubusercontent.com/u/5325824?v=3","gravatar_id":"","url":"https://api.github.com/users/MattSANU","html_url":"https://github.com/MattSANU","followers_url":"https://api.github.com/users/MattSANU/followers","following_url":"https://api.github.com/users/MattSANU/following{/other_user}","gists_url":"https://api.github.com/users/MattSANU/gists{/gist_id}","starred_url":"https://api.github.com/users/MattSANU/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/MattSANU/subscriptions","organizations_url":"https://api.github.com/users/MattSANU/orgs","repos_url":"https://api.github.com/users/MattSANU/repos","events_url":"https://api.github.com/users/MattSANU/events{/privacy}","received_events_url":"https://api.github.com/users/MattSANU/received_events","type":"User","site_admin":false},"created_at":"2015-07-29T10:58:27Z","updated_at":"2015-07-29T10:58:27Z","body":"Ok, PR sent. This is the minimal correct change, and I believe it's wholly sufficient too, but to be honest I'm not certain of that. The Access-Control-Request-Method header is required according to the spec, but maybe there are buggy clients out there? Maybe we should check for all of the possible Access-Control-Allow-Foo headers, just to ultra-paranoid? I dunno."}}