23 lines
955 B
C#
23 lines
955 B
C#
using Microsoft.AspNetCore.Mvc.Filters;
|
|
|
|
namespace FinlyticBackend.Util;
|
|
|
|
/// <summary>
|
|
/// A global authorization filter that short-circuits authorization checks for HTTP OPTIONS requests.
|
|
/// This is required for CORS preflight to succeed on endpoints protected with [Authorize]:
|
|
/// the browser sends a parameter-less OPTIONS request before the real request, and any 401
|
|
/// response on that preflight causes the actual request to be blocked with a CORS error.
|
|
/// </summary>
|
|
public class AllowOptionsFilter : IAuthorizationFilter
|
|
{
|
|
public void OnAuthorization(AuthorizationFilterContext context)
|
|
{
|
|
if (context.HttpContext.Request.Method == HttpMethods.Options)
|
|
{
|
|
// Return 204 No Content immediately — the manual CORS middleware in Program.cs
|
|
// has already written the Access-Control-Allow-* headers.
|
|
context.Result = new Microsoft.AspNetCore.Mvc.StatusCodeResult(204);
|
|
}
|
|
}
|
|
}
|