2026-10-28 14:25:25 -04:00
1 changed files with 7 additions and 0 deletions
@@ -44,3 +44,10 @@ def test_cors_events_soeur_preflight_get_et_tiers(client):
                        headers={"Origin": "https://evil.example",
                                 "Access-Control-Request-Method": "GET"})
    assert "access-control-allow-origin" not in r3.headers
+    # Correctif 2026-10-28 : une origine sœur dev passe aussi.
+    r4 = client.options("/api/events",
+                        headers={"Origin": "https://tiktak-dev.dracodev.net",
+                                 "Access-Control-Request-Method": "GET"})
+    assert r4.status_code == 200
+    assert r4.headers.get("access-control-allow-origin") == "https://tiktak-dev.dracodev.net"
+    assert r4.headers.get("access-control-allow-credentials") == "true"