CORS headers should apply to all responses

vercel · Feb 10, 2017 · 0919187 · 0919187
1 parent b7be348
commit 0919187
Showing 1 changed file with 15 additions and 15 deletions.
diff --git a/lib/server.js b/lib/server.js
@@ -15,6 +15,21 @@ const stream = require('send')
 const renderDirectory = require('./render')
 
 module.exports = async (req, res, flags, current, ignoredFiles) => {
+  const headers = {}
+
+  if (flags.cors) {
+    headers['Access-Control-Allow-Origin'] = '*'
+    headers['Access-Control-Allow-Headers'] = 'Origin, X-Requested-With, Content-Type, Accept, Range'
+  }
+
+  for (const header in headers) {
+    if (!{}.hasOwnProperty.call(headers, header)) {
+      continue
+    }
+
+    res.setHeader(header, headers[header])
+  }
+
   if (flags.auth) {
     const credentials = auth(req)
 
@@ -100,21 +115,6 @@ module.exports = async (req, res, flags, current, ignoredFiles) => {
     return stream(req, indexPath).pipe(res)
   }
 
-  const headers = {}
-
-  if (flags.cors) {
-    headers['Access-Control-Allow-Origin'] = '*'
-    headers['Access-Control-Allow-Headers'] = 'Origin, X-Requested-With, Content-Type, Accept, Range'
-  }
-
-  for (const header in headers) {
-    if (!{}.hasOwnProperty.call(headers, header)) {
-      continue
-    }
-
-    res.setHeader(header, headers[header])
-  }
-
   // Serve files without a mime type as text
   stream.mime.default_type = 'text/plain'