support Access-Control-Request-Headers

httpbin/core.py

@@ -58,6 +58,8 @@ def set_cors_headers(response):
         # http://www.w3.org/TR/cors/#access-control-allow-methods-response-header
         response.headers['Access-Control-Allow-Methods'] = 'GET, POST, PUT, DELETE, PATCH, OPTIONS'
         response.headers['Access-Control-Max-Age'] = '3600'  # 1 hour cache
+        if request.headers.get('Access-Control-Request-Headers', None) != None:
+            response.headers['Access-Control-Allow-Headers'] = request.headers.get('Access-Control-Request-Headers', "")
     return response
 
 

test_httpbin.py

@@ -101,7 +101,11 @@ class HttpbinTestCase(unittest.TestCase):
         self.assertNotIn(
             'Access-Control-Allow-Headers', response.headers
         )
-
+    def test_set_cors_allow_headers(self):
+        response = self.app.open('/get', method='OPTIONS', headers={'Access-Control-Request-Headers': 'X-Test-Header'})
+        self.assertEqual(
+            response.headers.get('Access-Control-Allow-Headers'), 'X-Test-Header'
+        )
     def test_user_agent(self):
         response = self.app.get(
             '/user-agent', headers={'User-Agent': 'test'}