{"action":"created","issue":{"url":"https://api.github.com/repos/goadesign/goa/issues/886","repository_url":"https://api.github.com/repos/goadesign/goa","labels_url":"https://api.github.com/repos/goadesign/goa/issues/886/labels{/name}","comments_url":"https://api.github.com/repos/goadesign/goa/issues/886/comments","events_url":"https://api.github.com/repos/goadesign/goa/issues/886/events","html_url":"https://github.com/goadesign/goa/issues/886","id":190582579,"number":886,"title":"When using JWT, CORS is not sent on 401","user":{"login":"jeremyguarini","id":23618053,"avatar_url":"https://avatars.githubusercontent.com/u/23618053?v=3","gravatar_id":"","url":"https://api.github.com/users/jeremyguarini","html_url":"https://github.com/jeremyguarini","followers_url":"https://api.github.com/users/jeremyguarini/followers","following_url":"https://api.github.com/users/jeremyguarini/following{/other_user}","gists_url":"https://api.github.com/users/jeremyguarini/gists{/gist_id}","starred_url":"https://api.github.com/users/jeremyguarini/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jeremyguarini/subscriptions","organizations_url":"https://api.github.com/users/jeremyguarini/orgs","repos_url":"https://api.github.com/users/jeremyguarini/repos","events_url":"https://api.github.com/users/jeremyguarini/events{/privacy}","received_events_url":"https://api.github.com/users/jeremyguarini/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2016-11-20T20:48:46Z","updated_at":"2016-11-21T07:13:13Z","closed_at":null,"body":"Hi,\r\n\r\nI noticed that when using the jwt middleware, CORS was not being sent when I used an expired token. I would get a 401 and no access-control headers. After refreshing the jwt token, I would get back 2XX and proper CORS headers. \r\n\r\nI found that patching handleSecurity in the generated app/security.go to include the same CORS code that is found in some of the app/controllers.go func then a 401 would return CORS. Re-running goagen would replace the app/security.go so I updated my local copy of github.com/goadesign/goa/goagen/gen_app/writess.go (very end of file that writes fun handleSecurity()) and github.com/goadesign/goa/goagen/gen_app/generator.go generateSecurity() to include goa/cors. After these changes, running goagen now includes the CORS stuff in handleSecurity(). It's a hack that works for my case, though I don't have proper template code in writers.go to handle $policy.Methods  or $policy.Headers as found in other parts of writes.go.\r\n\r\nIf you need more information please let me know.\r\n\r\nthanks,\r\nJeremy\r\n"},"comment":{"url":"https://api.github.com/repos/goadesign/goa/issues/comments/261860827","html_url":"https://github.com/goadesign/goa/issues/886#issuecomment-261860827","issue_url":"https://api.github.com/repos/goadesign/goa/issues/886","id":261860827,"user":{"login":"raphael","id":36822,"avatar_url":"https://avatars.githubusercontent.com/u/36822?v=3","gravatar_id":"","url":"https://api.github.com/users/raphael","html_url":"https://github.com/raphael","followers_url":"https://api.github.com/users/raphael/followers","following_url":"https://api.github.com/users/raphael/following{/other_user}","gists_url":"https://api.github.com/users/raphael/gists{/gist_id}","starred_url":"https://api.github.com/users/raphael/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/raphael/subscriptions","organizations_url":"https://api.github.com/users/raphael/orgs","repos_url":"https://api.github.com/users/raphael/repos","events_url":"https://api.github.com/users/raphael/events{/privacy}","received_events_url":"https://api.github.com/users/raphael/received_events","type":"User","site_admin":false},"created_at":"2016-11-21T07:13:13Z","updated_at":"2016-11-21T07:13:13Z","body":"Thanks for the report. Could you provide a complete design that reproduces the problem? thank you!"}}
{"actor":{"display_login":"raphael"}}