[CMS-13154] Page Model API does not allow credentials for requests other than OPTIONS - Issues

XML

Word

Printable

The Page Model API returns `Access-Control-Allow-Credentials: true` for OPTIONS requests, but it ignores others.

Reproduction Path:
Access the PMA from the same domain using UrlRewriter setup.

Actual:
PMA does not return `Access-Control-Allow-Credentials: true` header in response for GET or POST requests.

Expected:
PMA returns `Access-Control-Allow-Credentials: true` for GET and POST requests.

is a result of

HSTTWO-4703 Improve Cross-Origin Resource Sharing (CORS) HST support through preflight (OPTIONS) requests

relates to

CMS-13152 Configure SaaS setup to by default not allow credentials for Page Model API requests