#NEWLINE# def test_allow_headers( self ) : #NEWLINE# #INDENT# 'CORS Specification Section 6.2.10\n\n        Add one or more Access-Control-Allow-Headers headers consisting of\n        (a subset of) the list of headers.\n\n        If each of the header field-names is a simple header and none is\n        Content-Type, this step may be skipped.\n\n        If a header field name is a simple header and is not Content-Type, it\n        is not required to be listed. Content-Type is to be listed as only a\n        subset of its values makes it qualify as simple header.\n        ' #NEWLINE# requested_headers = 'Content-Type,X-Header-1,Cache-Control,Expires,Last-Modified,Pragma' #NEWLINE# request = webob . Request . blank ( '/' ) #NEWLINE# request . method = 'OPTIONS' #NEWLINE# request . headers [ 'Origin' ] = 'http://headers.example.com' #NEWLINE# request . headers [ 'Access-Control-Request-Method' ] = 'GET' #NEWLINE# request . headers [ 'Access-Control-Request-Headers' ] = requested_headers #NEWLINE# response = request . get_response ( request . application ) #NEWLINE# self . assertCORSResponse ( response , status = '200 OK' , allow_origin = 'http://headers.example.com' , max_age = None , allow_methods = 'GET' , allow_headers = requested_headers , allow_credentials = None , expose_headers = None )