Add support of CORS

[manifest]

Pull request for issue 947 "Make Cowboy CORS friendly".

[essen]

Thanks, a few comments. Note however that this will break in a week or two when I finally merge back my current set of changes (huge).

• I will not merge until I review the CORS specs, so please be patient
• I will not merge until there's tests or I have time to write some; those must be based on real-world use cases and added to a relevant Common Test suite (or a new suite must be created, probably this)
• It seems that there's parsing code in this PR. Header parsing code should be in cow_http_hd in cowlib (along with tests and benchmarks)
• I am not sure the function binary_join is necessary
• Use maps, the whole proplists converted to a record is completely unnecessary

[manifest]

I will write the tests. You're right about maps, it's a better choice. And we need the binary_join function at least for exposed headers.

[essen]

Hey, I will try to get to this this week-end. I finally read the CORS spec so we can move forward.

This seems like a good first step, but I think we should also better integrate CORS support with cowboy_rest. Most of the info can be filled automatically there, except the origin check, max-age and exposed-headers, so it could be very nice to have.

[essen]

Guessing this is for 'The string "" cannot be used for a resource that supports credentials.' but I'm not sure this is very useful, more useful would be sending Origin back instead of "" if credentials are allowed.

[manifest]

Actually, it's how it works now. User will get an Origin back if credentials are allowed. The only way he can get the "*" in the response the parser didn't fully recognize the Origin value or the value was "null" string, thus the parser returned an reference that can't be returned to the user. So we need this validation for the last case.

[hachreak]

Hi at all,
are there news about CORS for cowboy?
Thanks :)

[manifest]

@hachreak, the main conversation is here.

[hachreak]

hi @manifest, I saw that the PR for cowlib have been merged.
It's mean that also this PR will be merged too?
Thanks :)

[manifest]

@hachreak, this PR is currently obsoleted. You can implement the support of CORS in a way described in the last few comments here, using new functions of cowlib. Will it work for you?

[hachreak]

if you have time, can you add a example that show how it works? :)
This will be really useful to anyone want use it.

[manifest]

@hachreak, have you seen an example here? Is it not clear how you can implement CORS support from that example or you mean an example in the docs?

[hachreak]

I mean an example inside examples/ directory.

[manifest]

Ok, will do it.

[hachreak]

@manifest thanks a lot! :D