@@ -24,7 +24,9 @@ func TestWorkspaceAppCors(t *testing.T) {
2424Username :"user" ,
2525}
2626
27- handler := httpmw .WorkspaceAppCors (regex ,app )
27+ handler := httpmw .WorkspaceAppCors (regex ,app )(http .HandlerFunc (func (rw http.ResponseWriter ,r * http.Request ) {
28+ rw .WriteHeader (http .StatusNoContent )
29+ }))
2830methods := []string {
2931http .MethodOptions ,
3032http .MethodHead ,
@@ -72,15 +74,26 @@ func TestWorkspaceAppCors(t *testing.T) {
7274r .Header .Set ("Origin" ,test .origin )
7375rw := httptest .NewRecorder ()
7476
75- handler (http .HandlerFunc (func (rw http.ResponseWriter ,r * http.Request ) {
76- rw .WriteHeader (http .StatusOK )
77- })).ServeHTTP (rw ,r )
77+ // Preflight requests need to know what method will be requested.
78+ if method == http .MethodOptions {
79+ r .Header .Set ("Access-Control-Request-Method" ,method )
80+ }
81+
82+ handler .ServeHTTP (rw ,r )
7883
7984if test .allowed {
8085require .Equal (t ,test .origin ,rw .Header ().Get ("Access-Control-Allow-Origin" ))
8186}else {
8287require .Equal (t ,"" ,rw .Header ().Get ("Access-Control-Allow-Origin" ))
8388}
89+
90+ // For options we should never get to our handler as the middleware
91+ // short-circuits with a 200.
92+ if method == http .MethodOptions {
93+ require .Equal (t ,http .StatusOK ,rw .Code )
94+ }else {
95+ require .Equal (t ,http .StatusNoContent ,rw .Code )
96+ }
8497}
8598})
8699}