CORS headers for auth

Author: mevdschee

api.php

@@ -2292,21 +2292,20 @@ protected function swagger($settings) {
 	}
 
 	protected function allowOrigin($origin,$allowOrigins) {
-		if ($allowOrigins=='*') {
-			header('Access-Control-Allow-Origin: *');
-		} else {
-			if ($origin) foreach (explode(',',$allowOrigins) as $o) {
-				if (preg_match('/^'.str_replace('\*','.*',preg_quote(strtolower(trim($o)))).'$/',$origin)) { 
-					header('Access-Control-Allow-Origin: '.$origin);
-					break;
-				}
+		if ($origin) foreach (explode(',',$allowOrigins) as $o) {
+			if (preg_match('/^'.str_replace('\*','.*',preg_quote(strtolower(trim($o)))).'$/',$origin)) { 
+				header('Access-Control-Allow-Origin: '.$origin);
+				break;
 			}
+		} else {
+			header('Access-Control-Allow-Origin: *');
 		}
 	}
 
 	public function executeCommand() {
 		if (isset($_SERVER['REQUEST_METHOD'])) {
 			$this->allowOrigin($this->settings['origin'],$this->settings['allow_origin']);
+			header('Access-Control-Allow-Credentials: true');
 		}
 		if (!$this->settings['request']) {
 			$this->swagger($this->settings);