[To Staging] Add middleware to unconditionally set Access-Control-Allow-Origin hea…

rorapi/middleware/cors.py

@@ -0,0 +1,16 @@
+class AlwaysAllowOriginMiddleware:
+    """Always set Access-Control-Allow-Origin: * on responses.
+
+    django-cors-headers only adds this header when the request has an Origin
+    header. Edge caches that ignore Vary: Origin can then serve a no-Origin
+    response to browsers without ACAO. Setting * unconditionally makes those
+    cached responses safe for browsers (credentialed CORS is not used).
+    """
+
+    def __init__(self, get_response):
+        self.get_response = get_response
+
+    def __call__(self, request):
+        response = self.get_response(request)
+        response['Access-Control-Allow-Origin'] = '*'
+        return response

rorapi/settings.py

@@ -65,6 +65,7 @@
 MIDDLEWARE = [
     'django_prometheus.middleware.PrometheusBeforeMiddleware',
     'corsheaders.middleware.CorsMiddleware',
+    'rorapi.middleware.cors.AlwaysAllowOriginMiddleware',
     'django.middleware.common.CommonMiddleware',
     'django.middleware.security.SecurityMiddleware',
     'django.contrib.sessions.middleware.SessionMiddleware',

rorapi/tests/tests_unit/tests_cors.py

@@ -16,3 +16,18 @@ def test_preflight_allows_client_id_header(self):
         self.assertIsNotNone(allow_headers)
         allowed = [h.strip().lower() for h in allow_headers.split(',')]
         self.assertIn('client-id', allowed)
+
+
+class AlwaysAllowOriginTestCase(TestCase):
+    """Test that Access-Control-Allow-Origin: * is always present."""
+
+    def test_get_without_origin_has_acao_star(self):
+        response = self.client.get('/v2/heartbeat')
+        self.assertEqual(response['Access-Control-Allow-Origin'], '*')
+
+    def test_get_with_origin_has_acao_star(self):
+        response = self.client.get(
+            '/v2/heartbeat',
+            HTTP_ORIGIN='https://example.org',
+        )
+        self.assertEqual(response['Access-Control-Allow-Origin'], '*')