mozilla/webpagemaker — pull request #224 by brianloveswords (2012-05-31 22:04:41+00:00)
Title: Allow CORS only in when settings.DEV = True

(addresses issue #48)

We don't want the publishing API to be open to the entire world. This
adds a new decorator, `@development_cors` which adds in the CORS
header only when `settings.DEV` is truthy.

In the future we may have a subdomain-per-user model. When that happens,
we will need to change this to whitelist subdomains off of the current
origin of the application, but we can cross that bridge when we get there.

re: testing -- I'm not a django expert and I couldn't figure out an
elegant way to test this. There are already tests in place for making
sure there are CORS headers, so I tested this by manually toggling the
DEV flag in settings and making sure those specific tests failed. I
could not figure out a way to alter `settings.DEV` on a per-test (or
even per-suite) basis.

@cmcavoy, @davidascher could you review this and make sure I'm not
doing something insane? And if you can think of a better (any) way to
test this, let me know and I'll amend the request.