{"action":"opened","issue":{"url":"https://api.github.com/repos/eko3alpha/slim-cors-middleware/issues/1","repository_url":"https://api.github.com/repos/eko3alpha/slim-cors-middleware","labels_url":"https://api.github.com/repos/eko3alpha/slim-cors-middleware/issues/1/labels{/name}","comments_url":"https://api.github.com/repos/eko3alpha/slim-cors-middleware/issues/1/comments","events_url":"https://api.github.com/repos/eko3alpha/slim-cors-middleware/issues/1/events","html_url":"https://github.com/eko3alpha/slim-cors-middleware/issues/1","id":256735362,"number":1,"title":"Support for Access-Control-Allow-Credentials","user":{"login":"iambrosie","id":4072584,"avatar_url":"https://avatars3.githubusercontent.com/u/4072584?v=4","gravatar_id":"","url":"https://api.github.com/users/iambrosie","html_url":"https://github.com/iambrosie","followers_url":"https://api.github.com/users/iambrosie/followers","following_url":"https://api.github.com/users/iambrosie/following{/other_user}","gists_url":"https://api.github.com/users/iambrosie/gists{/gist_id}","starred_url":"https://api.github.com/users/iambrosie/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/iambrosie/subscriptions","organizations_url":"https://api.github.com/users/iambrosie/orgs","repos_url":"https://api.github.com/users/iambrosie/repos","events_url":"https://api.github.com/users/iambrosie/events{/privacy}","received_events_url":"https://api.github.com/users/iambrosie/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2017-09-11T15:02:43Z","updated_at":"2017-09-11T15:02:43Z","closed_at":null,"author_association":"NONE","body":"Hi Angel,\r\n\r\nI wanted to use slim-cors-middleware for a credentialed API, and I noticed the lack of support for setting the Access-Control-Allow-Credentials response header (and/or for Access-Control-Allow-Headers).\r\n\r\nThis would be useful in the following scenario:\r\n\r\n- API server running on http://api.example.com. Authorization is required e.g. using cookies.\r\n- API client running on http://api-client.example.com\r\n\r\nClient requests would look similar to:\r\n\r\n```GET /test HTTP/1.1\r\nHost: api.example.com\r\nUser-Agent: curl/7.55.1\r\nAccept: */*\r\nOrigin: http://api-client.example.com\r\nCookie: cookie_value\r\n```\r\n\r\nFor the client to be able to read the response, the server's response should include both Access-Control-Allow-Origin and Access-Control-Allow-Credentials, so a successful server response would look similar to:\r\n\r\n```HTTP/1.1 200 OK\r\nDate: Mon, 11 Sep 2017 14:51:56 GMT\r\nServer: Apache/2.4.25 (Ubuntu)\r\nAccess-Control-Allow-Origin: http://api-client.example.com\r\nAccess-Control-Allow-Credentials: true\r\nContent-Length: 139\r\nContent-Type: application/json;charset=utf-8\r\n\r\n{\"foo\":\"bar\"}\r\n```\r\n\r\nThanks!"}}
{"actor":{"display_login":"iambrosie"}}