Ensure all requests have exposed headers

Author: Ben Stahl

lib/Server.js

@@ -16,6 +16,7 @@ const HeadHandler = require('./handlers/HeadHandler');
 const PatchHandler = require('./handlers/PatchHandler');
 const TUS_RESUMABLE = require('./constants').TUS_RESUMABLE;
 const RequestValidator = require('./validators/RequestValidator');
+const EXPOSED_HEADERS = require('./constants').EXPOSED_HEADERS;
 
 class TusServer {
 
@@ -99,6 +100,8 @@ class TusServer {
             res.setHeader('Access-Control-Allow-Origin', req.headers.origin);
         }
 
+        res.setHeader('Access-Control-Expose-Headers', EXPOSED_HEADERS);
+
         // Handle POST, HEAD, PATCH, OPTIONS requests
         if (this.handlers[req.method]) {
             return this.handlers[req.method].send(req, res);

lib/constants.js

@@ -65,6 +65,7 @@ module.exports = {
     HEADERS_LOWERCASE,
     ALLOWED_METHODS: METHODS.join(', '),
     ALLOWED_HEADERS: HEADERS.join(', '),
+    EXPOSED_HEADERS: HEADERS.join(', '),
     MAX_AGE: 86400,
     ERRORS,
 };

lib/handlers/BaseHandler.js

@@ -1,7 +1,6 @@
 'use strict';
 
 const DataStore = require('../stores/DataStore');
-const EXPOSED_HEADERS = 'Upload-Offset, Location, Upload-Length, Tus-Version, Tus-Resumable, Tus-Max-Size, Tus-Extension, Upload-Metadata';
 
 class BaseHandler {
     constructor(store) {
@@ -25,7 +24,6 @@ class BaseHandler {
         body = body ? body : '';
         headers = Object.assign(headers, {
             'Content-Length': body.length,
-            'Access-Control-Expose-Headers': EXPOSED_HEADERS,
         });
 
         res.writeHead(status, headers);

test/Test-OptionsHandler.js

@@ -8,6 +8,7 @@ const DataStore = require('../lib/stores/DataStore');
 
 const ALLOWED_METHODS = require('../lib/constants').ALLOWED_METHODS;
 const ALLOWED_HEADERS = require('../lib/constants').ALLOWED_HEADERS;
+const EXPOSED_HEADERS = require('../lib/constants').EXPOSED_HEADERS;
 const MAX_AGE = require('../lib/constants').MAX_AGE;
 
 let hasHeader = (res, header) => {
@@ -31,7 +32,7 @@ describe('OptionsHandler', () => {
         let headers = {
             'Access-Control-Allow-Methods': ALLOWED_METHODS,
             'Access-Control-Allow-Headers': ALLOWED_HEADERS,
-            'Access-Control-Expose-Headers': ALLOWED_HEADERS,
+            'Access-Control-Expose-Headers': EXPOSED_HEADERS,
             'Access-Control-Max-Age': MAX_AGE,
         };
         handler.send(req, res);