Skip to content

Document Directus-File-Id header for TUS needs CORS_EXPOSED_HEADERS set for external domains #599

@julbd

Description

@julbd

Describe the Bug

With TUS file uploads, a Directus-File-Id HTTP header is returned instead of a proper response object. But it took me several hours to understand why i could not access it on the browser side, because I simply forget to set :

CORS_EXPOSED_HEADERS: "Directus-File-Id"

I don't know the potential security issues with enabling this by default, so I'm only asking this as a question : should the api return Access-Control-Expose-Headers: Directus-File-Id alongside the header ?

To Reproduce

Directus Version

v11.16.1

Hosting Strategy

Self-Hosted (Docker Image)

Database

No response

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions