fix: handle CORS pre-flight requests correctly

cabal.project

@@ -2,3 +2,7 @@ packages: postgrest.cabal
 tests: true
 package *
   ghc-options: -split-sections
+source-repository-package
+  type: git
+  location: https://github.com/laurenceisla/wai-cors.git
+  tag: e2da0d7a3e56592a5f4b35fd3aa6ccd3175525cc

nix/overlays/haskell-packages.nix

@@ -73,6 +73,15 @@ let
         { }
       );
 
+      wai-cors = lib.dontCheck (
+        prev.callCabal2nixWithOptions "wai-cors" (super.fetchFromGitHub {
+          owner = "laurenceisla";
+          repo  = "wai-cors";
+          rev = "e2da0d7a3e56592a5f4b35fd3aa6ccd3175525cc";
+          sha256 = "sha256-lTzFiH7c7ZpR+hg6jJXvPKM2DtwMs8gdjdk68GTmtaQ=";
+        }) "--subpath=." {}
+      );
+
     };
 in
 {

src/PostgREST/Cors.hs

@@ -39,7 +39,7 @@ corsPolicy corsAllowedOrigins req = case lookup "origin" headers of
     , Wai.corsMaxAge = Just $ 60*60*24
     , Wai.corsVaryOrigin = False
     , Wai.corsRequireOrigin = False
-    , Wai.corsIgnoreFailures = True
+    , Wai.corsIgnoreFailures = False
     }
   Nothing -> Nothing
   where

src/PostgREST/Response.hs

@@ -251,8 +251,7 @@ actionResponse (NoDbResult SchemaInfoPlan) _ _ _ _ _ _ = respondInfo "OPTIONS,GE
 
 respondInfo :: ByteString -> Either Error.Error PgrstResponse
 respondInfo allowHeader =
-  let allOrigins = ("Access-Control-Allow-Origin", "*") in
-  Right $ PgrstResponse HTTP.status200 [allOrigins, (HTTP.hAllow, allowHeader)] mempty
+  Right $ PgrstResponse HTTP.status200 [(HTTP.hAllow, allowHeader)] mempty
 
 -- Status and headers can be overridden as per https://postgrest.org/en/stable/references/transactions.html#response-headers
 overrideStatusHeaders :: Maybe Text -> Maybe BS.ByteString -> HTTP.Status -> [HTTP.Header]-> Either Error.Error (HTTP.Status, [HTTP.Header])

stack.yaml

@@ -13,3 +13,5 @@ extra-deps:
   - fuzzyset-0.2.4
   - hasql-notifications-0.2.2.0
   - hasql-pool-1.0.1
+  - git: https://github.com/laurenceisla/wai-cors.git
+    commit: e2da0d7a3e56592a5f4b35fd3aa6ccd3175525cc