Update CORS settings for ninja API endpoints

mozmeao · Dec 20, 2024 · 8a80a59 · 8a80a59
1 parent cd097b9
commit 8a80a59
Showing 1 changed file with 4 additions and 2 deletions.
diff --git a/basket/settings.py b/basket/settings.py
@@ -10,6 +10,7 @@
 import django_cache_url
 import markus
 import sentry_sdk
+from corsheaders.defaults import default_headers
 from everett.manager import ChoiceOf, ConfigManager, ConfigurationMissingError, ListOf
 from sentry_processor import DesensitizationProcessor
 from sentry_sdk.integrations.django import DjangoIntegration
@@ -232,8 +233,9 @@ def path(*args):
 CTMS_CLIENT_ID = config("CTMS_CLIENT_ID", default="")
 CTMS_CLIENT_SECRET = config("CTMS_CLIENT_SECRET", default="")
 
-CORS_ORIGIN_ALLOW_ALL = True
-CORS_URLS_REGEX = r"^/(news/|subscribe)"
+CORS_ALLOW_ALL_ORIGINS = True
+CORS_ALLOW_HEADERS = (*default_headers, "x-api-key")
+CORS_URLS_REGEX = r"^/(api/|news/|subscribe)"
 
 # view rate limiting
 RATELIMIT_VIEW = "basket.news.views.ratelimited"