feat: update default CORS settings

README.md

@@ -128,18 +128,36 @@ log:
 # CORS configuration
 cors:
   # Whether or not CORS configuration should be applied. Default is 'false'.
-  # This is an example of how you can enable CORS.
   enabled: true
   credentials: true
-  allowed_headers:
-    - Depth
+  # The following are the default CORS settings when it is enabled.
   allowed_hosts:
     - *
+  allowed_headers:
+    - Authorization
+    - Content-Type
+    - Depth
+    - Destination
+    - If
+    - Lock-Token
+    - Overwrite
+    - TimeOut
+    - Translate
   allowed_methods:
+    - COPY
+    - DELETE
     - GET
-  exposed_headers:
-    - Content-Length
-    - Content-Range
+    - HEAD
+    - LOCK
+    - UNLOCK
+    - MKCOL
+    - MOVE
+    - OPTIONS
+    - POST
+    - PROPFIND
+    - PROPPATCH
+    - PUT
+  exposed_headers: []
 
 # You define here the list of users.
 # Basic authentication is automatically be configured when users are detected 

lib/config.go

@@ -86,9 +86,9 @@ func ParseConfig(filename string, flags *pflag.FlagSet) (*Config, error) {
 	v.SetDefault("Log.Format", "console")
 	v.SetDefault("Log.Outputs", []string{"stderr"})
 	v.SetDefault("Log.Colors", true)
-	v.SetDefault("CORS.Allowed_Headers", []string{"*"})
 	v.SetDefault("CORS.Allowed_Hosts", []string{"*"})
-	v.SetDefault("CORS.Allowed_Methods", []string{"*"})
+	v.SetDefault("CORS.Allowed_Headers", []string{"Authorization", "Content-Type", "Depth", "Destination", "If", "Lock-Token", "Overwrite"})
+	v.SetDefault("CORS.Allowed_Methods", []string{"COPY", "DELETE", "GET", "HEAD", "LOCK", "MKCOL", "MOVE", "OPTIONS", "POST", "PROPFIND", "PROPPATCH", "PUT", "UNLOCK"})
 
 	// Read and unmarshal configuration
 	err := v.ReadInConfig()