{"push_id":1251900362,"size":1,"distinct_size":1,"ref":"refs/heads/4.1","head":"8d043cc4ddf585261b86fafbee52625be9a38f04","before":"fb3dc84e5b032323d842e07880f4b045a4fd459b","commits":[{"sha":"8d043cc4ddf585261b86fafbee52625be9a38f04","author":{"name":"Akhil","email":"9cf9682c70f402fe8ab7928c5632082646ef3d40@grubhub.com"},"message":"Do not return Access-Control-Allow-Headers on Non-Preflight Cors requests\n\nMotivation:\n\nThe CorsHandler currently returns the Access-Control-Allow-Headers\nheader as on a Non-Preflight CORS request (Simple request).\nAs per the CORS specification the Access-Control-Allow-Headers header\nshould only be returned on Preflight requests. (not on simple requests).\n\nhttps://www.w3.org/TR/2014/REC-cors-20140116/#access-control-allow-headers-response-header\n\nhttp://www.html5rocks.com/static/images/cors_server_flowchart.png\n\nModifications:\n\nModified CorsHandler.java to not add the Access-Control-Allow-Headers\nheader when responding to Non-preflight CORS request.\n\nResult:\n\nAccess-Control-Allow-Headers header will not be returned on a Simple\nrequest (Non-preflight CORS request).","distinct":true,"url":"https://api.github.com/repos/netty/netty/commits/8d043cc4ddf585261b86fafbee52625be9a38f04"}]}
{"actor":{"display_login":"normanmaurer"}}