Merge pull request #106 from restify/rm-cors

Remove CORS

Author: William Blankenship

Diff for: lib/plugins/cors.js

@@ -6,51 +6,11 @@ var crypto = require('crypto');
 var httpDate = require('../utils/httpDate');
 
 
-///--- Globals
-
-var ALLOW_HEADERS = [
-    'Accept',
-    'Accept-Version',
-    'Content-Length',
-    'Content-MD5',
-    'Content-Type',
-    'Date',
-    'Api-Version',
-    'Response-Time'
-].join(', ');
-
-var EXPOSE_HEADERS = [
-    'Api-Version',
-    'Request-Id',
-    'Response-Time'
-].join(', ');
-
-
 ///--- API
 
 function setHeaders(req, res) {
     var hash;
     var now = new Date();
-    var methods;
-
-    if (!res.getHeader('Access-Control-Allow-Origin')) {
-        res.setHeader('Access-Control-Allow-Origin', '*');
-    }
-
-    if (!res.getHeader('Access-Control-Allow-Headers')) {
-        res.setHeader('Access-Control-Allow-Headers', ALLOW_HEADERS);
-    }
-
-    if (!res.getHeader('Access-Control-Allow-Methods')) {
-        if (res.methods && res.methods.length > 0) {
-            methods = res.methods.join(', ');
-            res.setHeader('Access-Control-Allow-Methods', methods);
-        }
-    }
-
-    if (!res.getHeader('Access-Control-Expose-Headers')) {
-        res.setHeader('Access-Control-Expose-Headers', EXPOSE_HEADERS);
-    }
 
     if (!res.getHeader('Connection')) {
         res.setHeader('Connection',

Diff for: lib/plugins/fullResponse.js

@@ -65,7 +65,6 @@
     "prehandlers",
     "queryparser",
     "bodyparser",
-    "cors",
     "accept",
     "audit",
     "authorization",

Diff for: package.json

@@ -117,10 +117,6 @@ describe('all other plugins', function () {
                 assert.equal(res.statusCode, 200);
                 var headers = res.headers;
                 assert.ok(headers, 'headers ok');
-                assert.ok(headers['access-control-allow-origin']);
-                assert.ok(headers['access-control-allow-headers']);
-                assert.ok(headers['access-control-expose-headers']);
-                assert.ok(headers['access-control-allow-methods']);
                 assert.ok(headers.date);
                 assert.ok(headers['request-id']);
                 assert.ok(headers['response-time'] >= 0);