
from pyramid.events import NewRequest

def add_cors_headers(request, response):
    settings = request.registry.settings
    acac = settings['cors.access_control_allow_credentials']
    acao = settings['cors.access_control_allow_origin'].split()
    acah = settings['cors.access_control_allow_headers']
    acam = settings['cors.access_control_allow_methods']
    if acac:
        response.headerlist.append(
                ('Access-Control-Allow-Credentials', acac))
    if acao:
        if request.host in acao:
            response.headerlist.append(
                ('Access-Control-Allow-Origin', request.host))
        else:   
            response.headerlist.append(
                ('Access-Control-Allow-Origin', acao[0]))
    if acah:
        response.headerlist.append(
                ('Access-Control-Allow-Headers', acah))
    if acam:
        response.headerlist.append(
                ('Access-Control-Allow-Methods', acam))

def new_request_subscriber(event):
    request = event.request
    request.add_response_callback(add_cors_headers)

def main(config):
    config.add_subscriber(new_request_subscriber, NewRequest)


from pyramid.events import NewRequest

def add_cors_headers(request, response):
    settings = request.registry.settings
    acac = settings['cors.access_control_allow_credentials']
    acao = settings['cors.access_control_allow_origin'].split()
    acah = settings['cors.access_control_allow_headers']
    acam = settings['cors.access_control_allow_methods']
    if acac:
        response.headerlist.append(
                ('Access-Control-Allow-Credentials', acac))
    if acao:
        if request.headers.get('Origin') in acao:
            response.headerlist.append(
                ('Access-Control-Allow-Origin', request.headers.get('Origin')))
        else:   
            response.headerlist.append(
                ('Access-Control-Allow-Origin', acao[0]))
    if acah:
        response.headerlist.append(
                ('Access-Control-Allow-Headers', acah))
    if acam:
        response.headerlist.append(
                ('Access-Control-Allow-Methods', acam))

def new_request_subscriber(event):
    request = event.request
    request.add_response_callback(add_cors_headers)

def main(config):
    config.add_subscriber(new_request_subscriber, NewRequest)

Fix Access-Control-Allow-Origin to return the request origin
Fix Access-Control-Allow-Origin to return the request origin

request.host is the host part of the request url.  For example, if
webview is trying to access http://localhost:8080/users/profile,
request.  It's the Origin field in the headers that we should be
matching.

  
  from pyramid.events import NewRequest
  
  def add_cors_headers(request, response):
      settings = request.registry.settings
      acac = settings['cors.access_control_allow_credentials']
      acao = settings['cors.access_control_allow_origin'].split()
      acah = settings['cors.access_control_allow_headers']
      acam = settings['cors.access_control_allow_methods']
      if acac:
          response.headerlist.append(
                  ('Access-Control-Allow-Credentials', acac))
      if acao:
-         if request.host in acao:
+         if request.headers.get('Origin') in acao:
              response.headerlist.append(
-                 ('Access-Control-Allow-Origin', request.host))
+                 ('Access-Control-Allow-Origin', request.headers.get('Origin')))
          else:   
              response.headerlist.append(
                  ('Access-Control-Allow-Origin', acao[0]))
      if acah:
          response.headerlist.append(
                  ('Access-Control-Allow-Headers', acah))
      if acam:
          response.headerlist.append(
                  ('Access-Control-Allow-Methods', acam))
  
  def new_request_subscriber(event):
      request = event.request
      request.add_response_callback(add_cors_headers)
  
  def main(config):
      config.add_subscriber(new_request_subscriber, NewRequest)
  
Fix Access-Control-Allow-Origin to return the request origin
## Code Before:

from pyramid.events import NewRequest

def add_cors_headers(request, response):
    settings = request.registry.settings
    acac = settings['cors.access_control_allow_credentials']
    acao = settings['cors.access_control_allow_origin'].split()
    acah = settings['cors.access_control_allow_headers']
    acam = settings['cors.access_control_allow_methods']
    if acac:
        response.headerlist.append(
                ('Access-Control-Allow-Credentials', acac))
    if acao:
        if request.host in acao:
            response.headerlist.append(
                ('Access-Control-Allow-Origin', request.host))
        else:   
            response.headerlist.append(
                ('Access-Control-Allow-Origin', acao[0]))
    if acah:
        response.headerlist.append(
                ('Access-Control-Allow-Headers', acah))
    if acam:
        response.headerlist.append(
                ('Access-Control-Allow-Methods', acam))

def new_request_subscriber(event):
    request = event.request
    request.add_response_callback(add_cors_headers)

def main(config):
    config.add_subscriber(new_request_subscriber, NewRequest)

## Instruction:
Fix Access-Control-Allow-Origin to return the request origin
## Code After:

from pyramid.events import NewRequest

def add_cors_headers(request, response):
    settings = request.registry.settings
    acac = settings['cors.access_control_allow_credentials']
    acao = settings['cors.access_control_allow_origin'].split()
    acah = settings['cors.access_control_allow_headers']
    acam = settings['cors.access_control_allow_methods']
    if acac:
        response.headerlist.append(
                ('Access-Control-Allow-Credentials', acac))
    if acao:
        if request.headers.get('Origin') in acao:
            response.headerlist.append(
                ('Access-Control-Allow-Origin', request.headers.get('Origin')))
        else:   
            response.headerlist.append(
                ('Access-Control-Allow-Origin', acao[0]))
    if acah:
        response.headerlist.append(
                ('Access-Control-Allow-Headers', acah))
    if acam:
        response.headerlist.append(
                ('Access-Control-Allow-Methods', acam))

def new_request_subscriber(event):
    request = event.request
    request.add_response_callback(add_cors_headers)

def main(config):
    config.add_subscriber(new_request_subscriber, NewRequest)
