(self, message: Message, send: Send, request_headers: Headers)
| 149 | await self.app(scope, receive, send) |
| 150 | |
| 151 | async def send(self, message: Message, send: Send, request_headers: Headers) -> None: |
| 152 | if message["type"] != "http.response.start": |
| 153 | await send(message) |
| 154 | return |
| 155 | |
| 156 | message.setdefault("headers", []) |
| 157 | headers = MutableHeaders(scope=message) |
| 158 | origin = request_headers.get("Origin") |
| 159 | if origin is not None: |
| 160 | headers.update(self.simple_headers) |
| 161 | |
| 162 | # If credentials are allowed, then we must respond with the specific origin instead of '*'. |
| 163 | if origin is not None and self.allow_all_origins and self.allow_credentials: |
| 164 | self.allow_explicit_origin(headers, origin) |
| 165 | |
| 166 | # If we only allow specific origins, then we have to mirror back the Origin header in the response. |
| 167 | elif origin is not None and not self.allow_all_origins and self.is_allowed_origin(origin=origin): |
| 168 | self.allow_explicit_origin(headers, origin) |
| 169 | else: |
| 170 | headers["Vary"] = ", ".join([*headers.getlist("Vary"), "Origin"]) |
| 171 | |
| 172 | await send(message) |
| 173 | |
| 174 | @staticmethod |
| 175 | def allow_explicit_origin(headers: MutableHeaders, origin: str) -> None: |
no test coverage detected