FEATURE: Cache CORS preflight requests for 2h (#14614)

FEATURE: Cache CORS preflight requests for 2h (#14614)

  • FEATURE: Cache CORS preflight requests for 2h

Browsers will cache this for 5 seconds by default. If using MessageBus in a different domain, Discourse will issue a new long polling, by default, every 30s or so. This means we would be issuing a new preflight request every time. This can be incredibly wasteful, so let’s cache the authorization in the client for 2h, which is the maximum Chromium allows us as of today.

  • fix tests
diff --git a/config/initializers/008-rack-cors.rb b/config/initializers/008-rack-cors.rb
index 96ab5ba..b03fb25 100644
--- a/config/initializers/008-rack-cors.rb
+++ b/config/initializers/008-rack-cors.rb
@@ -45,6 +45,7 @@ class Discourse::Cors
       headers['Access-Control-Allow-Headers'] = 'Content-Type, Cache-Control, X-Requested-With, X-CSRF-Token, Discourse-Present, User-Api-Key, User-Api-Client-Id, Authorization'
       headers['Access-Control-Allow-Credentials'] = 'true'
       headers['Access-Control-Allow-Methods'] = 'POST, PUT, GET, OPTIONS, DELETE'
+      headers['Access-Control-Max-Age'] = '7200'
     end
 
     headers
diff --git a/spec/components/hijack_spec.rb b/spec/components/hijack_spec.rb
index 0ed3b0b..416ee41 100644
--- a/spec/components/hijack_spec.rb
+++ b/spec/components/hijack_spec.rb
@@ -110,7 +110,8 @@ describe Hijack do
       "Access-Control-Allow-Origin" => "www.rainbows.com",
       "Access-Control-Allow-Headers" => "Content-Type, Cache-Control, X-Requested-With, X-CSRF-Token, Discourse-Present, User-Api-Key, User-Api-Client-Id, Authorization",
       "Access-Control-Allow-Credentials" => "true",
-      "Access-Control-Allow-Methods" => "POST, PUT, GET, OPTIONS, DELETE"
+      "Access-Control-Allow-Methods" => "POST, PUT, GET, OPTIONS, DELETE",
+      "Access-Control-Max-Age" => "7200",
     }
 
     expect(headers).to eq(expected)
@@ -147,7 +148,8 @@ describe Hijack do
       "Access-Control-Allow-Origin" => "https://www.rainbows.com",
       "Access-Control-Allow-Headers" => "Content-Type, Cache-Control, X-Requested-With, X-CSRF-Token, Discourse-Present, User-Api-Key, User-Api-Client-Id, Authorization",
       "Access-Control-Allow-Credentials" => "true",
-      "Access-Control-Allow-Methods" => "POST, PUT, GET, OPTIONS, DELETE"
+      "Access-Control-Allow-Methods" => "POST, PUT, GET, OPTIONS, DELETE",
+      "Access-Control-Max-Age" => "7200",
     }
 
     expect(headers).to eq(expected)

GitHub sha: b301a6b3db288ef50fbbf736262de7eed71eb5ef

This commit appears in #14614 which was approved by tgxworld. It was merged by Falco.