{"action":"created","issue":{"url":"https://api.github.com/repos/corydolphin/flask-cors/issues/126","labels_url":"https://api.github.com/repos/corydolphin/flask-cors/issues/126/labels{/name}","comments_url":"https://api.github.com/repos/corydolphin/flask-cors/issues/126/comments","events_url":"https://api.github.com/repos/corydolphin/flask-cors/issues/126/events","html_url":"https://github.com/corydolphin/flask-cors/issues/126","id":79445711,"number":126,"title":"Using flask-cors with flask-security/flask-login","user":{"login":"bnmnetp","id":51115,"avatar_url":"https://avatars.githubusercontent.com/u/51115?v=3","gravatar_id":"","url":"https://api.github.com/users/bnmnetp","html_url":"https://github.com/bnmnetp","followers_url":"https://api.github.com/users/bnmnetp/followers","following_url":"https://api.github.com/users/bnmnetp/following{/other_user}","gists_url":"https://api.github.com/users/bnmnetp/gists{/gist_id}","starred_url":"https://api.github.com/users/bnmnetp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bnmnetp/subscriptions","organizations_url":"https://api.github.com/users/bnmnetp/orgs","repos_url":"https://api.github.com/users/bnmnetp/repos","events_url":"https://api.github.com/users/bnmnetp/events{/privacy}","received_events_url":"https://api.github.com/users/bnmnetp/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2015-05-22T12:56:32Z","updated_at":"2015-05-24T12:28:45Z","closed_at":null,"body":"Hi,\r\n\r\nI'm trying to get this work so that when I login I issue an ``'Access-Control-Allow-Credentials', 'true'`` header.  So that I can have authenticated cross-domain ajax calls.  I've got a simple prototype working, but now I'm trying to get this all to work in a larger flask application using the flask-security extension.\r\n\r\nHere's what I've tried for setting up CORS.  I've also tried using ``@cross_origin(supports_credentials=True)`` on a view that also requires a login.\r\n```\r\ncors = CORS(app, resources={r\"/api/*\": {\"origins\": \"*\"}, r\"/login\": {\"supports_credentials\": True}})\r\n```\r\nI don't get any of the CORS headers.   Here's what I see in the debug output.\r\n```\r\nDEBUG:flask.ext.cors:Enabling <function home at 0x1039e2b70> for cross_origin using options:{'supports_credentials': True}\r\nDEBUG:runestone.cors:Request to '/login' matches CORS resource '/login'. Using options: {'origins': ['.*'], 'supports_credentials': True, 'methods': 'DELETE, GET, HEAD, OPTIONS, PATCH, POST, PUT', 'intercept_exceptions': True, 'automatic_options': True, 'send_wildcard': False, 'vary_header': True, 'allow_headers': ['.*'], 'resources': {'/api/*': {'origins': '*'}, '/login': {'supports_credentials': True}}}\r\nDEBUG:runestone.cors:'Origin' header was not set, which means CORS was not requested, skipping\r\nDEBUG:runestone.cors:Settings CORS headers: MultiDict([])\r\nINFO:werkzeug:127.0.0.1 - - [22/May/2015 14:44:59] \"GET /login HTTP/1.1\" 302 -\r\nDEBUG:runestone.cors:No CORS rule matches\r\n```\r\n\r\nI don't know if it matters but I have the auth stuff in a blueprint of its own.\r\n\r\nAny ideas on where I might be going wrong?  The debug output is confusing to me because it seems to recognize that I want CORS on the login, request, but then later says that CORS was not requested.\r\n\r\nThanks,\r\n\r\nBrad\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/corydolphin/flask-cors/issues/comments/105009961","html_url":"https://github.com/corydolphin/flask-cors/issues/126#issuecomment-105009961","issue_url":"https://api.github.com/repos/corydolphin/flask-cors/issues/126","id":105009961,"user":{"login":"bnmnetp","id":51115,"avatar_url":"https://avatars.githubusercontent.com/u/51115?v=3","gravatar_id":"","url":"https://api.github.com/users/bnmnetp","html_url":"https://github.com/bnmnetp","followers_url":"https://api.github.com/users/bnmnetp/followers","following_url":"https://api.github.com/users/bnmnetp/following{/other_user}","gists_url":"https://api.github.com/users/bnmnetp/gists{/gist_id}","starred_url":"https://api.github.com/users/bnmnetp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bnmnetp/subscriptions","organizations_url":"https://api.github.com/users/bnmnetp/orgs","repos_url":"https://api.github.com/users/bnmnetp/repos","events_url":"https://api.github.com/users/bnmnetp/events{/privacy}","received_events_url":"https://api.github.com/users/bnmnetp/received_events","type":"User","site_admin":false},"created_at":"2015-05-24T12:28:45Z","updated_at":"2015-05-24T12:28:45Z","body":"I wrote this up:  http://reputablejournal.com/posts/2015/05/adventures-with-flask-cors.html\r\n\r\nWe could adapt this any way you like."}}