registerPostHandlingAdvice on OPTION request about drogon

[Mis1eader-dev]

To insecurely resolve all CORS issues, you can echo back everything the client asks for:

drogon::app()
		.registerSyncAdvice([](const HttpRequestPtr& req) -> HttpResponsePtr
		{
			if(req->method() == drogon::HttpMethod::Options)
			{
				auto resp = HttpResponse::newHttpResponse();
				{
					const auto& val = req->getHeader("Origin");
					if(!val.empty())
						resp->addHeader("Access-Control-Allow-Origin", val);
				}
				{
					const auto& val = req->getHeader("Access-Control-Request-Method");
					if(!val.empty())
						resp->addHeader("Access-Control-Allow-Methods", val);
				}
				resp->addHeader("Access-Control-Allow-Credentials", "true");
				{
					const auto& val = req->getHeader("Access-Control-Request-Headers");
					if(!val.empty())
						resp->addHeader("Access-Control-Allow-Headers", val);
				}
				return std::move(resp);
			}
			return {};
		})
		.registerPostHandlingAdvice([](const HttpRequestPtr& req, const HttpResponsePtr& resp) -> void
		{
			{
				const auto& val = req->getHeader("Origin");
				if(!val.empty())
					resp->addHeader("Access-Control-Allow-Origin", val);
			}
			{
				const auto& val = req->getHeader("Access-Control-Request-Method");
				if(!val.empty())
					resp->addHeader("Access-Control-Allow-Methods", val);
			}
			resp->addHeader("Access-Control-Allow-Credentials", "true");
			{
				const auto& val = req->getHeader("Access-Control-Request-Headers");
				if(!val.empty())
					resp->addHeader("Access-Control-Allow-Headers", val);
			}
		})
		.run();

[Mis1eader-dev]

Options is a preflight, it asks what it can do before actually doing it, that's why we respond separately for OPTION requests

[Mis1eader-dev]

If you do that then none of your API endpoints will be hit and the sync advice ends up responding to every request

[Alexufo]

Thanks @Mis1eader-dev it works.
Is there any reason not to set headers for all OPTIONS POST GET requests (not just OPTIONS) inside registerSyncAdvice?

[Alexufo]

@Mis1eader-dev I mean, why not respond to the POST GET in the registerSyncAdvice hook too?