Allow credentialed cross-origin API requests

Author: lpf950929

pkg/api/server.go

@@ -245,6 +245,7 @@ func (s *Server) withCORS(next http.Handler) http.Handler {
 		} else {
 			w.Header().Set("Access-Control-Allow-Origin", "*")
 		}
+		w.Header().Set("Access-Control-Allow-Credentials", "true")
 		allowMethods := strings.TrimSpace(r.Header.Get("Access-Control-Request-Method"))
 		if allowMethods == "" {
 			allowMethods = "GET, POST, PUT, PATCH, DELETE, OPTIONS"

pkg/api/server_test.go

@@ -193,6 +193,9 @@ func TestWithCORSEchoesPreflightHeaders(t *testing.T) {
 	if got := rec.Header().Get("Access-Control-Allow-Origin"); got != "https://dash.clawgo.dev" {
 		t.Fatalf("unexpected allow origin: %q", got)
 	}
+	if got := rec.Header().Get("Access-Control-Allow-Credentials"); got != "true" {
+		t.Fatalf("unexpected allow credentials: %q", got)
+	}
 	if got := rec.Header().Get("Access-Control-Allow-Methods"); got != "POST" {
 		t.Fatalf("unexpected allow methods: %q", got)
 	}