{"action":"created","issue":{"url":"https://api.github.com/repos/awslabs/serverless-application-model/issues/464","repository_url":"https://api.github.com/repos/awslabs/serverless-application-model","labels_url":"https://api.github.com/repos/awslabs/serverless-application-model/issues/464/labels{/name}","comments_url":"https://api.github.com/repos/awslabs/serverless-application-model/issues/464/comments","events_url":"https://api.github.com/repos/awslabs/serverless-application-model/issues/464/events","html_url":"https://github.com/awslabs/serverless-application-model/pull/464","id":330922832,"node_id":"MDExOlB1bGxSZXF1ZXN0MTkzNzk4NDgy","number":464,"title":"Feature/cors expose headers and allow credentials","user":{"login":"cast","id":770930,"node_id":"MDQ6VXNlcjc3MDkzMA==","avatar_url":"https://avatars2.githubusercontent.com/u/770930?v=4","gravatar_id":"","url":"https://api.github.com/users/cast","html_url":"https://github.com/cast","followers_url":"https://api.github.com/users/cast/followers","following_url":"https://api.github.com/users/cast/following{/other_user}","gists_url":"https://api.github.com/users/cast/gists{/gist_id}","starred_url":"https://api.github.com/users/cast/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cast/subscriptions","organizations_url":"https://api.github.com/users/cast/orgs","repos_url":"https://api.github.com/users/cast/repos","events_url":"https://api.github.com/users/cast/events{/privacy}","received_events_url":"https://api.github.com/users/cast/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":6,"created_at":"2018-06-09T22:11:17Z","updated_at":"2018-06-29T06:54:16Z","closed_at":null,"author_association":"NONE","pull_request":{"url":"https://api.github.com/repos/awslabs/serverless-application-model/pulls/464","html_url":"https://github.com/awslabs/serverless-application-model/pull/464","diff_url":"https://github.com/awslabs/serverless-application-model/pull/464.diff","patch_url":"https://github.com/awslabs/serverless-application-model/pull/464.patch"},"body":"Relates to issue https://github.com/awslabs/serverless-application-model/issues/463\r\n\r\nAdded support for CORS headers Access-Control-Expose-Headers and Access-Control-Allow-Credentials in the CORS Configuration block at the Serverless::Api resource.\r\n\r\nBy submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.\r\n"},"comment":{"url":"https://api.github.com/repos/awslabs/serverless-application-model/issues/comments/401265298","html_url":"https://github.com/awslabs/serverless-application-model/pull/464#issuecomment-401265298","issue_url":"https://api.github.com/repos/awslabs/serverless-application-model/issues/464","id":401265298,"node_id":"MDEyOklzc3VlQ29tbWVudDQwMTI2NTI5OA==","user":{"login":"cast","id":770930,"node_id":"MDQ6VXNlcjc3MDkzMA==","avatar_url":"https://avatars2.githubusercontent.com/u/770930?v=4","gravatar_id":"","url":"https://api.github.com/users/cast","html_url":"https://github.com/cast","followers_url":"https://api.github.com/users/cast/followers","following_url":"https://api.github.com/users/cast/following{/other_user}","gists_url":"https://api.github.com/users/cast/gists{/gist_id}","starred_url":"https://api.github.com/users/cast/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cast/subscriptions","organizations_url":"https://api.github.com/users/cast/orgs","repos_url":"https://api.github.com/users/cast/repos","events_url":"https://api.github.com/users/cast/events{/privacy}","received_events_url":"https://api.github.com/users/cast/received_events","type":"User","site_admin":false},"created_at":"2018-06-29T06:54:15Z","updated_at":"2018-06-29T06:54:15Z","author_association":"NONE","body":"Thanks @chrisoverzero for the spec review. Apart from a now fixed side effect leading me to think the allowed exposed headers was an issue in our internal development I added it mainly because other api management solutions often allow or force to take a liberal approach to preflight CORS (ApiMan, Axway,...). \r\n\r\nI'm not aware of specific browsers and browser versions that require the exposed header in the preflight response. I'm assuming if there is an issue it would be in old versions due to the current living standard.\r\n\r\nI'll remove the exposed headers parts."}}
{"actor":{"display_login":"cast"}}