fix for #2

CONTRIBUTING.md

@@ -0,0 +1,27 @@
+# contributing to `cors`
+
+CORS is a node.js package for providing a [connect](http://www.senchalabs.org/connect/)/[express](http://expressjs.com/) middleware that can be used to enable [CORS](http://en.wikipedia.org/wiki/Cross-origin_resource_sharing) with various options. Learn more about the project in [the README](README.md).
+
+[![build status](https://secure.travis-ci.org/TroyGoode/node-cors.png)](http://travis-ci.org/TroyGoode/node-cors)
+
+## The CORS Spec
+
+[http://www.w3.org/TR/cors/](http://www.w3.org/TR/cors/)
+
+## Pull Requests Welcome
+
+* Include `'use strict';` in every javascript file.
+* 2 space indentation.
+* Please run the testing steps below before submitting.
+
+## Testing
+
+```bash
+$ npm install
+$ npm test
+$ npm run lint
+```
+
+## License
+
+[MIT License](http://www.opensource.org/licenses/mit-license.php)

README.markdown → README.md

@@ -1,4 +1,4 @@
-# cors
+# `cors`
 
 CORS is a node.js package for providing a [connect](http://www.senchalabs.org/connect/)/[express](http://expressjs.com/) middleware that can be used to enable [CORS](http://en.wikipedia.org/wiki/Cross-origin_resource_sharing) with various options.
 

lib/index.js

@@ -6,8 +6,7 @@ var defaults, staticOptionsDelegate;
 
 defaults = {
   origin: '*',
-  methods: 'GET,PUT,POST,DELETE',
-  enablePreflight: true
+  methods: 'GET,PUT,POST,DELETE'
 };
 
 // the default delegate is used if static options are passed into the middleware
@@ -39,7 +38,6 @@ module.exports = function(param){
       config = options || defaults;
       config.origin = config.origin === undefined ? defaults.origin : config.origin;
       config.methods = config.methods || defaults.methods;
-      config.enablePreflight = config.enablePreflight === undefined ? defaults.enablePreflight : config.enablePreflight;
 
       // turn ORIGIN into a string
       if(config.origin === true){
@@ -76,7 +74,7 @@ module.exports = function(param){
       }
 
       // if this HTTP request is an *OPTIONS* request, short-circuit (if we're allowed to do so) rather than going to next middleware
-      if(config.enablePreflight && 'OPTIONS' === req.method){
+      if('OPTIONS' === req.method){
         res.header('Access-Control-Allow-Methods', methods); // required
         if(headers && headers.length){
           res.header('Access-Control-Allow-Headers', headers);
@@ -97,3 +95,13 @@ module.exports = function(param){
     delegate(req, handleDelegateResponse);
   };
 };
+
+module.exports.preflight = function(param){
+  return function(req, res, next){
+    if(req.method === 'OPTIONS'){
+      module.exports(param)(req, res, next);
+    }else{
+      next();
+    }
+  };
+};

test/cors.js

@@ -68,28 +68,6 @@ describe('cors', function(){
     cors()(req, res, next);
   });
 
-  it('can disabled shortcircuiting preflight requests', function(done){
-    // arrange
-    var req, res, next, options;
-    options = {
-      enablePreflight: false
-    };
-    req = fakeRequest();
-    req.method = 'OPTIONS';
-    res = fakeResponse();
-    res.send = function(code){
-      // assert
-      done('should not be called');
-    };
-    next = function(){
-      // assert
-      done();
-    };
-
-    // act
-    cors(options)(req, res, next);
-  });
-
   it('no options enables default CORS to all origins', function(done){
     // arrange
     var req, res, next;

test/example-app.js

@@ -24,9 +24,7 @@ simpleApp.post('/', cors(), function(req, res){
 /* -------------------------------------------------------------------------- */
 
 var complexApp = express();
-complexApp.all('/', cors(), function(req, res, next){
-  next();
-});
+complexApp.options('/', cors.preflight());
 complexApp.del('/', cors(), function(req, res){
   res.send('Hello World (Delete)');
 });

test/issue-2.js

@@ -15,17 +15,28 @@ var app = express(),
       origin: true,
       methods: ['POST'],
       credentials: true,
-      maxAge: 3600,
-      enablePreflight: true
+      maxAge: 3600
     };
+app.options('/api/login', cors.preflight(corsOptions));
 app.post('/api/login', cors(corsOptions), function(req, res){
   res.send('LOGIN');
 });
 
 /* -------------------------------------------------------------------------- */
 
 describe('issue  #2', function(){
-  it('is fixed', function(done){
+  it('OPTIONS works', function(done){
+    supertest(app)
+      .options('/api/login')
+      .expect(204)
+      .set('Origin', 'http://example.com')
+      .end(function(err, res){
+        should.not.exist(err);
+        res.headers['access-control-allow-origin'].should.eql('http://example.com');
+        done();
+      });
+  });
+  it('POST works', function(done){
     supertest(app)
       .post('/api/login')
       .expect(200)