CORS support (Step 3)

RELEASE_NOTES.md

@@ -5,6 +5,7 @@ Release Notes v1.6 (Under Development)
 Changes
 -------
 
+- Support Cross-Origin Resource Sharing (CORS) for static files and scripts (bel)
 - Win32: Replace dll.def file by export macros in civetweb.h (CSTAJ)
 - Base64 encode and decode functions for Lua (bel)
 - Support pre-loaded files for the Lua environment (bel)
@@ -14,7 +15,7 @@ Changes
 - Added Lua extensions: send_file, get_var, get_mime_type, get_cookie, url_decode, url_encode (bel)
 - mg_set_request_handler() mod to use pattern (bel, Patch from Toni Wilk)
 - Solved, tested and documented SSL support for Windows (bel)
-- Fixed: select for Linux needs the nfds parameter set correctly  (bel) 
+- Fixed: select for Linux needs the nfds parameter set correctly (bel)
 - Add methods for returning the ports civetweb is listening on (keithel)
 - Fixes for Lua Server Pages, as described within the google groups thread. (bel)
 - Added support for plain Lua Scripts, and an example script. (bel)
@@ -36,7 +37,7 @@ Changes
 
 - Corrected bad mask flag/opcode passing to websocket callback (William Greathouse)
 - Moved CEVITWEB_VERSION define into civetweb.h
-- Added new simple zip deployment build for Windows. 
+- Added new simple zip deployment build for Windows.
 - Removed windows install package build.
 - Fixes page violation in mod_lua.inl (apkbox)
 - Use C style comments to enable compiling most of civetweb with -ansi. (F-Secure Corporation)
@@ -85,7 +86,7 @@ Changes
 - Conformed source files to UNIX line endings for consistency.
 - Unified the coding style to improve reability.
 
-Release Notes v1.3 
+Release Notes v1.3
 ===
 ### Objectives: *Buildroot Integration*
 
@@ -97,7 +98,7 @@ Changes
 - Updated documentation
 - Updated Buildroot config example
 
-Release Notes v1.2 
+Release Notes v1.2
 ===
 ### Objectives: *Installation Improvements, buildroot, cross compile support*
 The objective of this release is to make installation seamless.
@@ -121,7 +122,7 @@ Known Issues
 
 - The prebuilt Window's version requires [Visual C++ Redistributable for Visual Studio 2012](http://www.microsoft.com/en-us/download/details.aspx?id=30679)
 
-Release Notes v1.1 
+Release Notes v1.1
 ===
 ### Objectives: *Build, Documentation, License Improvements*
 The objective of this release is to establish a maintable code base, ensure MIT license rights and improve usability and documentation.
@@ -150,7 +151,7 @@ Changes
      + Removed yaSSL from the OSX build, not needed.
 - Added new Visual Studio projects for Windows builds.
      + Removed Windows support from Makefiles
-     + Provided additional, examples with Lua, and another with yaSSL. 
+     + Provided additional, examples with Lua, and another with yaSSL.
 - Changed Zombie Reaping policy to not ignore SIGCHLD.
      + The previous method caused trouble in applciations that spawn children.
 
@@ -160,7 +161,7 @@ Known Issues
 - Build support for VS6 and some other has been deprecated.
     + This does not impact embedded programs, just the stand-alone build.
     + The old Makefile was renamed to Makefile.deprecated.
-    + This is partcially do to lack fo testing. 
+    + This is partcially do to lack fo testing.
     + Need to find out what is actually in demand.
 - Build changes may impact current users.
     + As with any change of this type, changes may impact some users.

src/civetweb.c

@@ -5338,6 +5338,8 @@ static void handle_request(struct mg_connection *conn)
                use_request_handler(conn)) {
         /* Do nothing, callback has served the request */
     } else if (!is_script_resource && !strcmp(ri->request_method, "OPTIONS")) {
+        /* Scripts should support the OPTIONS method themselves, to allow a maximum flexibility.
+           Lua and CGI scripts may fully support CORS this way (including preflights). */
         send_options(conn);
     } else if (conn->ctx->config[DOCUMENT_ROOT] == NULL) {
         send_http_error(conn, 404, "Not Found", "Not Found");