davidtinker/grails-cors — pull request #10 by sriddell (2013-04-24 15:43:18+00:00)
Title: Added support for Access-Control-Expose-Headers in the response.

I'd like to thank you for this plugin; I was hitting the grails bug that wouldn't allow OPTIONS methods through to my controller when I found your solution.

For the work I'm doing, I needed to support the Access-Control-Expose-Headers in the response; this pull request contains my simple solution to add support as well as tighten the origin checking to be closer to my reading of the W3C spec, along with additional unit tests.

I'd greatly appreciate any feedback/discussion on the proposed changes (whether you agree with them or not). If you disagree with them, or would like to see them implemented differently, please let me know, as I'd much prefer to see the feature added to your plugin than to maintain my own fork.

The only potential non-backward compatible change I have introduced is that I am checking that the Origin header exists and is a match on all requests (per my read of the W3C CORS spec), where as previously, the filter would add CORS headers to the response for any request if the origin regex was not being used. The filter will now always set the value of the Origin header (if accepted as a match) in the Access-Control-Allow-Origin response header. (Again, my read of the W3C spec that requires that behavior when returning Access-Control-Allow-Credentials with a true value.)

Note that I set the version to 1.0.5-SNAPSHOT for my own development.

Looking forward to your comments.

Thanks again for the plugin,
Shane Riddell