Repository: Kinto/kinto

Issue:
Missing CORS header on /v1/buckets/default/collections/tasks/records
> 09:19:55,733 Blocage d'une requête multi-origines (Cross-Origin Request) : la politique « Same Origin » ne permet pas de consulter la ressource distante située sur http://0.0.0.0:8888/v1/buckets/default/collections/tasks/records?_since=1436512795672. Raison : l'en-tête CORS « Access-Control-Allow-Origin » est manquant.1 <inconnu>



Discussion:
This happens only when going the default bucket view.

Indeed, when using the «absolute» bucket id, the problem disappears.

We should use the reapply_cors decorator on the default pyramid view.

:+1: !

I can't reproduce locally:

```
$ http "http://0.0.0.0:8888/v1/buckets/default/collections/articles/records?_since=1234" Origin:localhost:8000 --auth=user:pass
HTTP/1.1 200 OK
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Backoff, Retry-After, Alert, Next-Page, Total-Records, Last-Modified, ETag
Content-Length: 11
Content-Type: application/json; charset=UTF-8
Date: Fri, 10 Jul 2015 10:39:56 GMT
Etag: "1436524796357"
Last-Modified: Fri, 10 Jul 2015 10:39:56 GMT
Server: waitress
Total-Records: 0

{
    "data": []
}
```

The header `Access-Control-Allow-Origin: *` seems to be returned.

You can reproduce on 304:

```
$ http "http://0.0.0.0:8888/v1/buckets/default/collections/articles/records?_since=1436524796357" \
    Origin:localhost:8000 --auth=user:pass
```


Resolving patch:
diff --git a/kinto/views/buckets.py b/kinto/views/buckets.py
--- a/kinto/views/buckets.py
+++ b/kinto/views/buckets.py
@@ -1,12 +1,13 @@
 from six import text_type
 from uuid import UUID
 
-from pyramid.httpexceptions import HTTPForbidden, HTTPPreconditionFailed
+from pyramid.httpexceptions import (HTTPForbidden, HTTPPreconditionFailed,
+                                    HTTPException)
 from pyramid.security import NO_PERMISSION_REQUIRED
 from pyramid.view import view_config
 
 from cliquet import resource
-from cliquet.utils import hmac_digest, build_request
+from cliquet.utils import hmac_digest, build_request, reapply_cors
 
 from kinto.views import NameGenerator
 
@@ -86,7 +87,11 @@ def default_bucket(request):
         'body': request.body
     })
 
-    return request.invoke_subrequest(subrequest)
+    try:
+        response = request.invoke_subrequest(subrequest)
+    except HTTPException as error:
+        response = reapply_cors(subrequest, error)
+    return response
 
 
 @resource.register(name='bucket',


Test patch:
diff --git a/kinto/tests/test_default_bucket.py b/kinto/tests/test_default_bucket.py
--- a/kinto/tests/test_default_bucket.py
+++ b/kinto/tests/test_default_bucket.py
@@ -67,3 +67,17 @@ def test_option_is_possible_without_authentication_for_default(self):
                              'Origin': 'http://localhost:8000',
                              'Access-Control-Request-Method': 'GET',
                              'Access-Control-Request-Headers': headers})
+
+    def test_cors_headers_are_provided_on_errors(self):
+        resp = self.app.post_json(self.collection_url + '/records',
+                                  MINIMALIST_RECORD,
+                                  headers=self.headers)
+        current = resp.json['data']['last_modified']
+        headers = self.headers.copy()
+        headers.update({
+            'Origin': 'http://localhost:8000',
+            'If-None-Match': ('"%s"' % current).encode('utf-8')
+        })
+        resp = self.app.get(self.collection_url + '/records',
+                            headers=headers, status=304)
+        self.assertIn('Access-Control-Allow-Origin', resp.headers)