fix(cors): expose rate limit headers to clients

2020-07-17 19:00:16 +02:00
parent f1173cee6a
commit 7de5a51247
2 changed files with 5 additions and 1 deletions
@@ -3,6 +3,8 @@ export default function corsMiddleware (req, res, next) {
    'Access-Control-Allow-Origin': req.header('origin') || '*',
    'Access-Control-Allow-Methods': 'OPTIONS,GET,POST,PUT,HEAD,DELETE',
    'Access-Control-Allow-Headers': 'Authorization,Content-Type,Accept,Content-Encoding,X-Requested-With,x-api-user,x-api-key,x-client',
+    // Expose rate limit headers to CORS requests
+    'Access-Control-Expose-Headers': 'X-RateLimit-Limit,X-RateLimit-Remaining,X-RateLimit-Reset,Retry-After',
  });
  if (req.method === 'OPTIONS') return res.sendStatus(200);
  return next();