Access-Control-Allow-Headers. about django-cors-headers HOT 6 CLOSED

That is already documented. In settings.py you set CORS_ALLOW_HEADERS to whichever iterable you like.

from django-cors-headers.

Well although this is works, but the default doesn't seem to include popular cases such as DNT? I have DNT setup by default so it tripped up CORS. If the default does not include that to make the developer add it explicitly then:

1. we should document that
2. can we separate the default_headers tuple from the defaults.py file so it can be imported and then extended so as to avoid entering all the default headers on top? Or some other mechanism to do both default and custom headers?

from django-cors-headers.

Because of inactivity of the project and no answer of the author our team decide to fork it. Please create an issue if this is always required.

from django-cors-headers.

Both @eskhool's second suggestion (would need to make default_headers a list to be mutable), plus adding DNT to default_headers by default, sound like good ideas.

from django-cors-headers.

Since the #127 dynamic settings refactor it is now possible to import default_headers and default_methods from corsheaders.defaults and use them in your own settings. This is now documented in the README and is available on PyPI as version 1.2.1.

I don't know about adding DNT to the defaults, I'm unsure whether there are any security implications. Will research it a bit more.

from django-cors-headers.

Made #138 to track the final step adding DNT.

from django-cors-headers.