{"action":"created","comment":{"url":"https://api.github.com/repos/mozilla-services/cornice/pulls/comments/34262722","id":34262722,"diff_hunk":"@@ -228,15 +228,6 @@ def test_resp_dont_include_allow_origin(self):\n         self.assertNotIn('Access-Control-Allow-Origin', resp.headers)\n         self.assertEqual(resp.json, 'squirels')\n \n-    def test_resp_allow_origin_wildcard(self):\n-        resp = self.app.options(\n-            '/cors_klass',\n-            status=200,\n-            headers={\n-                'Origin': 'lolnet.org',\n-                'Access-Control-Request-Method': 'POST'})\n-        self.assertEqual(resp.headers['Access-Control-Allow-Origin'], '*')","path":"cornice/tests/test_cors.py","position":11,"original_position":11,"commit_id":"bff02a7e07b261a895826dad41c815ef00e6d83b","original_commit_id":"bff02a7e07b261a895826dad41c815ef00e6d83b","user":{"login":"treerao","id":874052,"avatar_url":"https://avatars.githubusercontent.com/u/874052?v=3","gravatar_id":"","url":"https://api.github.com/users/treerao","html_url":"https://github.com/treerao","followers_url":"https://api.github.com/users/treerao/followers","following_url":"https://api.github.com/users/treerao/following{/other_user}","gists_url":"https://api.github.com/users/treerao/gists{/gist_id}","starred_url":"https://api.github.com/users/treerao/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/treerao/subscriptions","organizations_url":"https://api.github.com/users/treerao/orgs","repos_url":"https://api.github.com/users/treerao/repos","events_url":"https://api.github.com/users/treerao/events{/privacy}","received_events_url":"https://api.github.com/users/treerao/received_events","type":"User","site_admin":false},"body":"Two ways to support removing this test case:\r\n\r\n1) it is technically incorrect in CORS to return what this test wants to see i.e. the * should not be returned in AC-Allow-Origin when withCredentials is used.  I found this explicitly stated in Monsur Hossain's book CORS in Action and also in a few StackOverflow threads, most [notably here](http://stackoverflow.com/questions/19743396/cors-cannot-use-wildcard-in-access-control-allow-origin-when-credentials-flag-i/19744754#19744754)\r\n\r\n2) The test right after this eliminated test has the same issue that is resolved in the fix.  The AC-Allow-Credentials header is not a request header, but rather a response header, so it shouldn't be set by the client.  When you delete it, you then have 2 tests that expect contradictory results, so one needs to be eliminated anyway.\r\n\r\nMake sense?","created_at":"2015-07-09T14:46:19Z","updated_at":"2015-07-09T14:46:19Z","html_url":"https://github.com/mozilla-services/cornice/pull/320#discussion_r34262722","pull_request_url":"https://api.github.com/repos/mozilla-services/cornice/pulls/320","_links":{"self":{"href":"https://api.github.com/repos/mozilla-services/cornice/pulls/comments/34262722"},"html":{"href":"https://github.com/mozilla-services/cornice/pull/320#discussion_r34262722"},"pull_request":{"href":"https://api.github.com/repos/mozilla-services/cornice/pulls/320"}}},"pull_request":{"url":"https://api.github.com/repos/mozilla-services/cornice/pulls/320","id":39435796,"html_url":"https://github.com/mozilla-services/cornice/pull/320","diff_url":"https://github.com/mozilla-services/cornice/pull/320.diff","patch_url":"https://github.com/mozilla-services/cornice/pull/320.patch","issue_url":"https://api.github.com/repos/mozilla-services/cornice/issues/320","number":320,"state":"open","locked":false,"title":"fix check for cors allow credentials","user":{"login":"treerao","id":874052,"avatar_url":"https://avatars.githubusercontent.com/u/874052?v=3","gravatar_id":"","url":"https://api.github.com/users/treerao","html_url":"https://github.com/treerao","followers_url":"https://api.github.com/users/treerao/followers","following_url":"https://api.github.com/users/treerao/following{/other_user}","gists_url":"https://api.github.com/users/treerao/gists{/gist_id}","starred_url":"https://api.github.com/users/treerao/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/treerao/subscriptions","organizations_url":"https://api.github.com/users/treerao/orgs","repos_url":"https://api.github.com/users/treerao/repos","events_url":"https://api.github.com/users/treerao/events{/privacy}","received_events_url":"https://api.github.com/users/treerao/received_events","type":"User","site_admin":false},"body":"As per my submission of #319, I was hitting  CORS issue when using credentials.  In particular, I get the following error:\r\n\r\n> XMLHttpRequest cannot load '....' A wildcard '*' cannot be used in the 'Access-Control- Allow-Origin' header when the credentials flag is true. Origin '....' is therefore not allowed access.\r\n\r\nWhat I think should be happening is the server should be setting the 'Access-Control-Allow-Origin' response header to the origin provided in the credentialed request. I've replaced an incorrect check of a request header, Access-Control-Allow-Credentials, which is really a response header with a correct test on the service definition.\r\n","created_at":"2015-07-08T02:18:56Z","updated_at":"2015-07-09T14:46:19Z","closed_at":null,"merged_at":null,"merge_commit_sha":"5e86806787c0e03a9b7fc81c7916f87b501d602a","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/mozilla-services/cornice/pulls/320/commits","review_comments_url":"https://api.github.com/repos/mozilla-services/cornice/pulls/320/comments","review_comment_url":"https://api.github.com/repos/mozilla-services/cornice/pulls/comments{/number}","comments_url":"https://api.github.com/repos/mozilla-services/cornice/issues/320/comments","statuses_url":"https://api.github.com/repos/mozilla-services/cornice/statuses/bff02a7e07b261a895826dad41c815ef00e6d83b","head":{"label":"treerao:corsfix","ref":"corsfix","sha":"bff02a7e07b261a895826dad41c815ef00e6d83b","user":{"login":"treerao","id":874052,"avatar_url":"https://avatars.githubusercontent.com/u/874052?v=3","gravatar_id":"","url":"https://api.github.com/users/treerao","html_url":"https://github.com/treerao","followers_url":"https://api.github.com/users/treerao/followers","following_url":"https://api.github.com/users/treerao/following{/other_user}","gists_url":"https://api.github.com/users/treerao/gists{/gist_id}","starred_url":"https://api.github.com/users/treerao/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/treerao/subscriptions","organizations_url":"https://api.github.com/users/treerao/orgs","repos_url":"https://api.github.com/users/treerao/repos","events_url":"https://api.github.com/users/treerao/events{/privacy}","received_events_url":"https://api.github.com/users/treerao/received_events","type":"User","site_admin":false},"repo":{"id":38725161,"name":"cornice","full_name":"treerao/cornice","owner":{"login":"treerao","id":874052,"avatar_url":"https://avatars.githubusercontent.com/u/874052?v=3","gravatar_id":"","url":"https://api.github.com/users/treerao","html_url":"https://github.com/treerao","followers_url":"https://api.github.com/users/treerao/followers","following_url":"https://api.github.com/users/treerao/following{/other_user}","gists_url":"https://api.github.com/users/treerao/gists{/gist_id}","starred_url":"https://api.github.com/users/treerao/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/treerao/subscriptions","organizations_url":"https://api.github.com/users/treerao/orgs","repos_url":"https://api.github.com/users/treerao/repos","events_url":"https://api.github.com/users/treerao/events{/privacy}","received_events_url":"https://api.github.com/users/treerao/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/treerao/cornice","description":"restful services for pyramid","fork":true,"url":"https://api.github.com/repos/treerao/cornice","forks_url":"https://api.github.com/repos/treerao/cornice/forks","keys_url":"https://api.github.com/repos/treerao/cornice/keys{/key_id}","collaborators_url":"https://api.github.com/repos/treerao/cornice/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/treerao/cornice/teams","hooks_url":"https://api.github.com/repos/treerao/cornice/hooks","issue_events_url":"https://api.github.com/repos/treerao/cornice/issues/events{/number}","events_url":"https://api.github.com/repos/treerao/cornice/events","assignees_url":"https://api.github.com/repos/treerao/cornice/assignees{/user}","branches_url":"https://api.github.com/repos/treerao/cornice/branches{/branch}","tags_url":"https://api.github.com/repos/treerao/cornice/tags","blobs_url":"https://api.github.com/repos/treerao/cornice/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/treerao/cornice/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/treerao/cornice/git/refs{/sha}","trees_url":"https://api.github.com/repos/treerao/cornice/git/trees{/sha}","statuses_url":"https://api.github.com/repos/treerao/cornice/statuses/{sha}","languages_url":"https://api.github.com/repos/treerao/cornice/languages","stargazers_url":"https://api.github.com/repos/treerao/cornice/stargazers","contributors_url":"https://api.github.com/repos/treerao/cornice/contributors","subscribers_url":"https://api.github.com/repos/treerao/cornice/subscribers","subscription_url":"https://api.github.com/repos/treerao/cornice/subscription","commits_url":"https://api.github.com/repos/treerao/cornice/commits{/sha}","git_commits_url":"https://api.github.com/repos/treerao/cornice/git/commits{/sha}","comments_url":"https://api.github.com/repos/treerao/cornice/comments{/number}","issue_comment_url":"https://api.github.com/repos/treerao/cornice/issues/comments{/number}","contents_url":"https://api.github.com/repos/treerao/cornice/contents/{+path}","compare_url":"https://api.github.com/repos/treerao/cornice/compare/{base}...{head}","merges_url":"https://api.github.com/repos/treerao/cornice/merges","archive_url":"https://api.github.com/repos/treerao/cornice/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/treerao/cornice/downloads","issues_url":"https://api.github.com/repos/treerao/cornice/issues{/number}","pulls_url":"https://api.github.com/repos/treerao/cornice/pulls{/number}","milestones_url":"https://api.github.com/repos/treerao/cornice/milestones{/number}","notifications_url":"https://api.github.com/repos/treerao/cornice/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/treerao/cornice/labels{/name}","releases_url":"https://api.github.com/repos/treerao/cornice/releases{/id}","created_at":"2015-07-08T01:46:53Z","updated_at":"2015-07-08T01:46:53Z","pushed_at":"2015-07-08T04:50:18Z","git_url":"git://github.com/treerao/cornice.git","ssh_url":"git@github.com:treerao/cornice.git","clone_url":"https://github.com/treerao/cornice.git","svn_url":"https://github.com/treerao/cornice","homepage":"http://cornice.rtfd.org","size":2409,"stargazers_count":0,"watchers_count":0,"language":"Python","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"mozilla-services:master","ref":"master","sha":"6647ac4401b53d60eb405d76bc83cbd53052de3e","user":{"login":"mozilla-services","id":1066228,"avatar_url":"https://avatars.githubusercontent.com/u/1066228?v=3","gravatar_id":"","url":"https://api.github.com/users/mozilla-services","html_url":"https://github.com/mozilla-services","followers_url":"https://api.github.com/users/mozilla-services/followers","following_url":"https://api.github.com/users/mozilla-services/following{/other_user}","gists_url":"https://api.github.com/users/mozilla-services/gists{/gist_id}","starred_url":"https://api.github.com/users/mozilla-services/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mozilla-services/subscriptions","organizations_url":"https://api.github.com/users/mozilla-services/orgs","repos_url":"https://api.github.com/users/mozilla-services/repos","events_url":"https://api.github.com/users/mozilla-services/events{/privacy}","received_events_url":"https://api.github.com/users/mozilla-services/received_events","type":"Organization","site_admin":false},"repo":{"id":2562442,"name":"cornice","full_name":"mozilla-services/cornice","owner":{"login":"mozilla-services","id":1066228,"avatar_url":"https://avatars.githubusercontent.com/u/1066228?v=3","gravatar_id":"","url":"https://api.github.com/users/mozilla-services","html_url":"https://github.com/mozilla-services","followers_url":"https://api.github.com/users/mozilla-services/followers","following_url":"https://api.github.com/users/mozilla-services/following{/other_user}","gists_url":"https://api.github.com/users/mozilla-services/gists{/gist_id}","starred_url":"https://api.github.com/users/mozilla-services/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mozilla-services/subscriptions","organizations_url":"https://api.github.com/users/mozilla-services/orgs","repos_url":"https://api.github.com/users/mozilla-services/repos","events_url":"https://api.github.com/users/mozilla-services/events{/privacy}","received_events_url":"https://api.github.com/users/mozilla-services/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/mozilla-services/cornice","description":"restful services for pyramid","fork":false,"url":"https://api.github.com/repos/mozilla-services/cornice","forks_url":"https://api.github.com/repos/mozilla-services/cornice/forks","keys_url":"https://api.github.com/repos/mozilla-services/cornice/keys{/key_id}","collaborators_url":"https://api.github.com/repos/mozilla-services/cornice/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/mozilla-services/cornice/teams","hooks_url":"https://api.github.com/repos/mozilla-services/cornice/hooks","issue_events_url":"https://api.github.com/repos/mozilla-services/cornice/issues/events{/number}","events_url":"https://api.github.com/repos/mozilla-services/cornice/events","assignees_url":"https://api.github.com/repos/mozilla-services/cornice/assignees{/user}","branches_url":"https://api.github.com/repos/mozilla-services/cornice/branches{/branch}","tags_url":"https://api.github.com/repos/mozilla-services/cornice/tags","blobs_url":"https://api.github.com/repos/mozilla-services/cornice/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/mozilla-services/cornice/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/mozilla-services/cornice/git/refs{/sha}","trees_url":"https://api.github.com/repos/mozilla-services/cornice/git/trees{/sha}","statuses_url":"https://api.github.com/repos/mozilla-services/cornice/statuses/{sha}","languages_url":"https://api.github.com/repos/mozilla-services/cornice/languages","stargazers_url":"https://api.github.com/repos/mozilla-services/cornice/stargazers","contributors_url":"https://api.github.com/repos/mozilla-services/cornice/contributors","subscribers_url":"https://api.github.com/repos/mozilla-services/cornice/subscribers","subscription_url":"https://api.github.com/repos/mozilla-services/cornice/subscription","commits_url":"https://api.github.com/repos/mozilla-services/cornice/commits{/sha}","git_commits_url":"https://api.github.com/repos/mozilla-services/cornice/git/commits{/sha}","comments_url":"https://api.github.com/repos/mozilla-services/cornice/comments{/number}","issue_comment_url":"https://api.github.com/repos/mozilla-services/cornice/issues/comments{/number}","contents_url":"https://api.github.com/repos/mozilla-services/cornice/contents/{+path}","compare_url":"https://api.github.com/repos/mozilla-services/cornice/compare/{base}...{head}","merges_url":"https://api.github.com/repos/mozilla-services/cornice/merges","archive_url":"https://api.github.com/repos/mozilla-services/cornice/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/mozilla-services/cornice/downloads","issues_url":"https://api.github.com/repos/mozilla-services/cornice/issues{/number}","pulls_url":"https://api.github.com/repos/mozilla-services/cornice/pulls{/number}","milestones_url":"https://api.github.com/repos/mozilla-services/cornice/milestones{/number}","notifications_url":"https://api.github.com/repos/mozilla-services/cornice/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/mozilla-services/cornice/labels{/name}","releases_url":"https://api.github.com/repos/mozilla-services/cornice/releases{/id}","created_at":"2011-10-12T13:17:51Z","updated_at":"2015-07-09T14:39:31Z","pushed_at":"2015-07-08T07:57:10Z","git_url":"git://github.com/mozilla-services/cornice.git","ssh_url":"git@github.com:mozilla-services/cornice.git","clone_url":"https://github.com/mozilla-services/cornice.git","svn_url":"https://github.com/mozilla-services/cornice","homepage":"http://cornice.rtfd.org","size":2409,"stargazers_count":228,"watchers_count":228,"language":"Python","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":110,"mirror_url":null,"open_issues_count":60,"forks":110,"open_issues":60,"watchers":228,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/mozilla-services/cornice/pulls/320"},"html":{"href":"https://github.com/mozilla-services/cornice/pull/320"},"issue":{"href":"https://api.github.com/repos/mozilla-services/cornice/issues/320"},"comments":{"href":"https://api.github.com/repos/mozilla-services/cornice/issues/320/comments"},"review_comments":{"href":"https://api.github.com/repos/mozilla-services/cornice/pulls/320/comments"},"review_comment":{"href":"https://api.github.com/repos/mozilla-services/cornice/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/mozilla-services/cornice/pulls/320/commits"},"statuses":{"href":"https://api.github.com/repos/mozilla-services/cornice/statuses/bff02a7e07b261a895826dad41c815ef00e6d83b"}}}}