http: CORS - add Access-Control-Allow-Credentials header for cookies

diff --git a/src/http.c b/src/http.c
index 3a9a1a8d0aa56cf6556f6a7a8be71d7e85843a58..a16930babd2e67fa0de8acee91a826c53f0d3b2a 100644 (file)
--- a/src/http.c
+++ b/src/http.c
@@ -337,6 +337,7 @@ http_send_header(http_connection_t *hc, int rc, const char *content,
       htsbuf_qprintf(&hdrs, "Access-Control-Allow-Origin: %s\r\n", config.cors_origin);
       htsbuf_append_str(&hdrs, "Access-Control-Allow-Methods: POST, GET, OPTIONS\r\n");
       htsbuf_append_str(&hdrs, "Access-Control-Allow-Headers: x-requested-with,authorization\r\n");
+      htsbuf_append_str(&hdrs, "Access-Control-Allow-Credentials: true\r\n");
     }
   }