spumko/hapi — pull request #738 by MathieuLoutre (2013-04-05 19:48:27+00:00)
Title: Support for Access-Control-Expose-Headers in the CORS options

Added options to CORS to include custom Access-Control-Expose-Headers. It's using the same mechanisms as headers and methods options (a main one with default, in this case to 'WWW-Authenticate, Server-Authorization', and an additional one to add instead of override).

These headers are necessary when making a CORS request to force the getReponseHeader() method of the XmlHttpRequest2 object:

"Access-Control-Expose-Headers (optional) - The XmlHttpRequest2 object has a getResponseHeader() method that returns the value of a particular response header. During a CORS request, the getResponseHeader() method can only access simple response headers. Simple response headers are defined as follows:
* Cache-Control
* Content-Language
* Content-Type
* Expires
* Last-Modified
* Pragma
If you want clients to be able to access other headers, you have to use the Access-Control-Expose-Headers header. The value of this header is a comma-delimited list of response headers you want to expose to the client." (http://www.html5rocks.com/en/tutorials/cors/#toc-handling-a-simple-request)

The real testing of this feature is hard because it depends on an implementation of XmlHttpRequest2 to make sure that the headers which are specified are truly exposed because this "blindness" is only due to XmlHttpRequest2. Still, I added a test for existence of the default exposed headers where I found the test for existence of the default headers.