)]}'
{"test/unit/proxy/test_server.py":[{"author":{"_account_id":13852,"name":"Romain LE DISEZ","email":"romain.le-disez@corp.ovh.com","username":"rledisez"},"change_message_id":"530049327fd945348a2dd9a90920b342468d0591","unresolved":false,"context_lines":[{"line_number":553,"context_line":""},{"line_number":554,"context_line":""},{"line_number":555,"context_line":"@patch_policies([StoragePolicy(0, \u0027zero\u0027, True, object_ring\u003dFakeRing())])"},{"line_number":556,"context_line":"class TestProxySeverConfiguration(unittest.TestCase):"},{"line_number":557,"context_line":"    def _make_app(self, conf):"},{"line_number":558,"context_line":"        # helper function to instantiate a proxy server instance"},{"line_number":559,"context_line":"        return proxy_server.Application(conf, FakeMemcache(),"}],"source_content_type":"text/x-python","patch_set":1,"id":"7a25e98e_fbe1d3ff","line":556,"range":{"start_line":556,"start_character":15,"end_line":556,"end_character":20},"updated":"2017-03-13 21:08:15.000000000","message":"missing letter: SeRver","commit_id":"a7fa7900fc1ab0ed393b6dc30714213aedc5c15c"},{"author":{"_account_id":13852,"name":"Romain LE DISEZ","email":"romain.le-disez@corp.ovh.com","username":"rledisez"},"change_message_id":"530049327fd945348a2dd9a90920b342468d0591","unresolved":false,"context_lines":[{"line_number":582,"context_line":"        self.assertTrue(app.strict_cors_mode)"},{"line_number":583,"context_line":""},{"line_number":584,"context_line":"        app \u003d self._make_app({"},{"line_number":585,"context_line":"            \u0027cors_allow_origin\u0027: \u0027 http://X.com,http://Y.com ,,  http://Z.com\u0027,"},{"line_number":586,"context_line":"            \u0027cors_expose_headers\u0027: \u0027 custom1,,,  custom2,custom3,,\u0027,"},{"line_number":587,"context_line":"            \u0027strict_cors_mode\u0027: \u0027False\u0027})"},{"line_number":588,"context_line":"        self.assertEqual({\u0027http://X.com\u0027, \u0027http://Y.com\u0027, \u0027http://Z.com\u0027},"}],"source_content_type":"text/x-python","patch_set":1,"id":"7a25e98e_cded3a27","line":585,"range":{"start_line":585,"start_character":35,"end_line":585,"end_character":47},"updated":"2017-03-13 21:08:15.000000000","message":"It\u0027s an interesting test because if i browse http://X.com with a web browser, the Origin header sent by browser will be lowercase while proxy-server does not do any case modification on the configuration. The CORS allow origin check should probably be case insensitive.","commit_id":"a7fa7900fc1ab0ed393b6dc30714213aedc5c15c"},{"author":{"_account_id":13852,"name":"Romain LE DISEZ","email":"romain.le-disez@corp.ovh.com","username":"rledisez"},"change_message_id":"1f7713d74b4bcd909cc0464784476c08a22493f6","unresolved":false,"context_lines":[{"line_number":582,"context_line":"        self.assertTrue(app.strict_cors_mode)"},{"line_number":583,"context_line":""},{"line_number":584,"context_line":"        app \u003d self._make_app({"},{"line_number":585,"context_line":"            \u0027cors_allow_origin\u0027: \u0027 http://X.com,http://Y.com ,,  http://Z.com\u0027,"},{"line_number":586,"context_line":"            \u0027cors_expose_headers\u0027: \u0027 custom1,,,  custom2,custom3,,\u0027,"},{"line_number":587,"context_line":"            \u0027strict_cors_mode\u0027: \u0027False\u0027})"},{"line_number":588,"context_line":"        self.assertEqual({\u0027http://X.com\u0027, \u0027http://Y.com\u0027, \u0027http://Z.com\u0027},"}],"source_content_type":"text/x-python","patch_set":1,"id":"5a22e58a_dc36c3b3","line":585,"range":{"start_line":585,"start_character":35,"end_line":585,"end_character":47},"in_reply_to":"5a22e58a_337c6b20","updated":"2017-03-14 13:17:49.000000000","message":"My bad, I misunderstood the statement. You\u0027re right, it\u0027s case sensitive.","commit_id":"a7fa7900fc1ab0ed393b6dc30714213aedc5c15c"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"83ce3ebd161c82d9b0ddf98300956cc9797e44e6","unresolved":false,"context_lines":[{"line_number":582,"context_line":"        self.assertTrue(app.strict_cors_mode)"},{"line_number":583,"context_line":""},{"line_number":584,"context_line":"        app \u003d self._make_app({"},{"line_number":585,"context_line":"            \u0027cors_allow_origin\u0027: \u0027 http://X.com,http://Y.com ,,  http://Z.com\u0027,"},{"line_number":586,"context_line":"            \u0027cors_expose_headers\u0027: \u0027 custom1,,,  custom2,custom3,,\u0027,"},{"line_number":587,"context_line":"            \u0027strict_cors_mode\u0027: \u0027False\u0027})"},{"line_number":588,"context_line":"        self.assertEqual({\u0027http://X.com\u0027, \u0027http://Y.com\u0027, \u0027http://Z.com\u0027},"}],"source_content_type":"text/x-python","patch_set":1,"id":"5a22e58a_337c6b20","line":585,"range":{"start_line":585,"start_character":35,"end_line":585,"end_character":47},"in_reply_to":"5a22e58a_5a93c1fa","updated":"2017-03-14 11:59:05.000000000","message":"If I understand this [1] correctly, CORS origin should be matched case-sensitive.\n\n[1] https://www.w3.org/TR/2010/WD-cors-20100727/#resource-processing-model","commit_id":"a7fa7900fc1ab0ed393b6dc30714213aedc5c15c"},{"author":{"_account_id":13852,"name":"Romain LE DISEZ","email":"romain.le-disez@corp.ovh.com","username":"rledisez"},"change_message_id":"d3f7969780f0bc0f81d715e26b1f2658ec5d4c8f","unresolved":false,"context_lines":[{"line_number":582,"context_line":"        self.assertTrue(app.strict_cors_mode)"},{"line_number":583,"context_line":""},{"line_number":584,"context_line":"        app \u003d self._make_app({"},{"line_number":585,"context_line":"            \u0027cors_allow_origin\u0027: \u0027 http://X.com,http://Y.com ,,  http://Z.com\u0027,"},{"line_number":586,"context_line":"            \u0027cors_expose_headers\u0027: \u0027 custom1,,,  custom2,custom3,,\u0027,"},{"line_number":587,"context_line":"            \u0027strict_cors_mode\u0027: \u0027False\u0027})"},{"line_number":588,"context_line":"        self.assertEqual({\u0027http://X.com\u0027, \u0027http://Y.com\u0027, \u0027http://Z.com\u0027},"}],"source_content_type":"text/x-python","patch_set":1,"id":"5a22e58a_5a93c1fa","line":585,"range":{"start_line":585,"start_character":35,"end_line":585,"end_character":47},"in_reply_to":"7a25e98e_7cbeb600","updated":"2017-03-14 09:20:22.000000000","message":"I think I badly explained my thought. Let\u0027s take the following request:\ncurl -i \u0027http://storage.example.com/v1/AUTH_abc/mycontainer\u0027 -X OPTIONS -H \u0027Origin: http://example.com\u0027 -H \u0027Access-Control-Request-Method: POST\u0027\n\n1. mycontainer does not exist \u003d\u003e returns 401\n\n2. mycontainer exists with X-Container-Meta-Access-Control-Allow-Origin: http://example.com \u003d\u003e returns 200\n\n3. mycontainer exists with X-Container-Meta-Access-Control-Allow-Origin: HTTP://EXAMPLE.COM \u003d\u003e returns 401\n\n\nWhile 1 and 2 are ok, I think that 3 should return 200 too. AFAIK, CORS allow origin is supposed to be case insensitive, and it\u0027s clear it\u0027s not in Swift right now.","commit_id":"a7fa7900fc1ab0ed393b6dc30714213aedc5c15c"},{"author":{"_account_id":597,"name":"Pete Zaitcev","email":"zaitcev@kotori.zaitcev.us","username":"zaitcev"},"change_message_id":"1b68f052e9e80e59a3104d09d574710ce5618128","unresolved":false,"context_lines":[{"line_number":582,"context_line":"        self.assertTrue(app.strict_cors_mode)"},{"line_number":583,"context_line":""},{"line_number":584,"context_line":"        app \u003d self._make_app({"},{"line_number":585,"context_line":"            \u0027cors_allow_origin\u0027: \u0027 http://X.com,http://Y.com ,,  http://Z.com\u0027,"},{"line_number":586,"context_line":"            \u0027cors_expose_headers\u0027: \u0027 custom1,,,  custom2,custom3,,\u0027,"},{"line_number":587,"context_line":"            \u0027strict_cors_mode\u0027: \u0027False\u0027})"},{"line_number":588,"context_line":"        self.assertEqual({\u0027http://X.com\u0027, \u0027http://Y.com\u0027, \u0027http://Z.com\u0027},"}],"source_content_type":"text/x-python","patch_set":1,"id":"7a25e98e_7cbeb600","line":585,"range":{"start_line":585,"start_character":35,"end_line":585,"end_character":47},"in_reply_to":"7a25e98e_cded3a27","updated":"2017-03-13 23:36:20.000000000","message":"I don\u0027t see what the problem is. Surely the check itself is case-insensitive, but no matter if it is, there\u0027s nothing we can do about it, because it\u0027s located in JavaScript engine of the browser. Our job is to take the additional hosts (as URLs) and add them to the Access-Control-Expose-Headers as is, and that should work fine.","commit_id":"a7fa7900fc1ab0ed393b6dc30714213aedc5c15c"}]}