-- http://www.html5rocks.com/static/images/cors_server_flowchart.png | |
if not mg.request_info.http_headers.Origin and not mg.request_info.http_headers.origin then | |
mg.write("HTTP/1.0 200 OK\r\n") | |
mg.write("Connection: close\r\n") | |
mg.write("Content-Type: text/html; charset=utf-8\r\n") | |
mg.write("\r\n") | |
mg.write("This test page should not be used directly. Open cors.html instead.") | |
return | |
end | |
if mg.request_info.request_method == "OPTIONS" then | |
-- Note: This is a test example showing how a script could handle | |
-- a preflight request directly. However, now the server is able | |
-- to handle preflight requests, so scripts do no longer need to | |
-- do this - except it has been disabled in the server by setting | |
-- the access_control_allow_methods configuration parameter to | |
-- an empty string. | |
local acrm = mg.request_info.http_headers['Access-Control-Request-Method']; | |
if (acrm) then | |
local acrh = nil -- mg.request_info.http_headers['Access-Control-Request-Header']; | |
if (acrm~='PUT') then | |
-- invalid request | |
mg.write("HTTP/1.0 403 Forbidden\r\n") | |
mg.write("Connection: close\r\n") | |
mg.write("\r\n") | |
return | |
else | |
-- preflight request | |
mg.write("HTTP/1.0 200 OK\r\n") | |
mg.write("Access-Control-Allow-Methods: PUT\r\n") | |
if (acrh) then | |
mg.write("Access-Control-Allow-Headers: " .. acrh .. "\r\n") | |
end | |
mg.write("Access-Control-Allow-Origin: *\r\n") | |
mg.write("Connection: close\r\n") | |
mg.write("Content-Type: text/html; charset=utf-8\r\n") | |
mg.write("\r\n") | |
return | |
end | |
end | |
end | |
-- actual request | |
if mg.request_info.request_method == "GET" then | |
mg.write("HTTP/1.0 200 OK\r\n") | |
mg.write("Access-Control-Allow-Origin: *\r\n") | |
mg.write("Connection: close\r\n") | |
mg.write("Content-Type: text/html; charset=utf-8\r\n") | |
mg.write("\r\n") | |
mg.write([[<!DOCTYPE html> | |
<html> | |
<head><title>CORS dynamic GET test reply - test OK</title></head> | |
<body>This should never be shown</body> | |
</html> | |
]]) | |
return | |
end | |
if mg.request_info.request_method == "PUT" then | |
mg.write("HTTP/1.0 200 OK\r\n") | |
mg.write("Access-Control-Allow-Origin: *\r\n") | |
mg.write("Connection: close\r\n") | |
mg.write("Content-Type: text/html; charset=utf-8\r\n") | |
mg.write("\r\n") | |
mg.write([[<!DOCTYPE html> | |
<html> | |
<head><title>CORS dynamic PUT test reply - test OK</title></head> | |
<body>This should never be shown</body> | |
</html> | |
]]) | |
return | |
end | |
-- other HTTP method | |
mg.write("HTTP/1.0 403 Forbidden\r\n") | |
mg.write("Connection: close\r\n") | |
mg.write("\r\n") | |