feat: add header-first local token controls - #3
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 11952452d2
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| ), | ||
| 403, | ||
| ) | ||
| return view(*args, **kwargs) |
There was a problem hiding this comment.
When a protected Flask route is declared with async def, Flask sees this synchronous wrapper and therefore does not apply its async adapter to the wrapped view. The direct call returns a coroutine as the response value, causing the otherwise supported async route to fail at runtime instead of executing; invoke the view through current_app.ensure_sync(view) so the decorator preserves Flask's async-view behavior.
Useful? React with 👍 / 👎.
| response.headers["Access-Control-Allow-Headers"] = ( | ||
| "Content-Type, Authorization, X-CSRF-Token" | ||
| "Content-Type, Authorization, X-CSRF-Token, X-Report-Token, X-Auth-Token" | ||
| ) |
There was a problem hiding this comment.
When require_local_token is configured with a header other than the two built-ins, an allowed-origin browser client cannot call the route because this preflight response never includes that custom header in Access-Control-Allow-Headers; the browser blocks the request before the decorator can validate it. Since header_name is a public configurable argument, the app's CORS configuration also needs a way to permit configured token-header names.
Useful? React with 👍 / 👎.
1 participant
Summary
Validation