1074806 - Remove Access-Control-Allow-Credentials branch from CORS middleware

Status: RESOLVED FIXED

(Marketplace Graveyard :: Code Quality, defect, P4)

Description

[Mathieu Pillard [:mat]]

In our CORS middleware, we check if an API is coming from fireplace origin and add Access-Control-Allow-Credentials to the response if that's the case. The check is done with:

    fireplace_url = settings.FIREPLACE_URL
    fireplacey = request.META.get('HTTP_ORIGIN') == fireplace_url

But AFAIK settings.FIREPLACE_URL is always set to ''. Furthermore, we don't use cookies in fireplace for auth and our AuthenticationMiddleware even prevents cookie-based auth from working with the API as a security measure.

I believe we should be able to remove those checks from CORSMiddleware and simplify it as a result.

Comment 1

[Andy McKay]

https://github.com/mozilla/zamboni/pull/2853