wisdom-framework/wisdom — pull request #382 by magnet (2014-11-30 22:44:22+00:00)
Title: Implemented CORS as a Wisdom filter

An implementation of CORS as a Wisdom filter.

There are a few points I'm not sure about, but I tried to follow the spec.
* The status reported when the preflight request fails. I return Unauthorized, but it's not mandated by the spec. I just read here and there that there should be some check server-side, but if I don't mark the error it feels pretty stupid. However even in that situation I return the appropriate CORS headers.
* Not sure about the whole allowed/exposed headers. My solution is to use expose-headers in a regular CORS request, and return allow-headers in the preflight request.

As of now, preflight requests are still somewhat costly because of the call to getRoutes() that copies the whole thing. If there are many routes, it's not so nice, so I'll try to propose a patch to the RequestRouter. I feel adding a route should be more expensive than reading them, but and I'm sure it's possible to find a good trade-off.