Fix more compatibility issues.
Python 3 uncovered actual issue with us relying on ordering inside a set
which doesn't guarantee ordering.
@@ -20,7 +20,9 @@ from webob.headers import ResponseHeaders
from st2common.constants.api import REQUEST_ID_HEADER
from st2common.constants.auth import HEADER_ATTRIBUTE_NAME
from st2common.constants.auth import HEADER_API_KEY_ATTRIBUTE_NAME
-from st2common.router import Request, Response
+from st2common.util.types import OrderedSet
+from st2common.router import Request
+from st2common.router import Response
class CorsMiddleware(object):
@@ -41,7 +43,7 @@ class CorsMiddleware(object):
headers = ResponseHeaders(headers)
origin = request.headers.get('Origin')
- origins = set(cfg.CONF.api.allow_origin)
+ origins = OrderedSet(cfg.CONF.api.allow_origin)
# Build a list of the default allowed origins
public_api_url = cfg.CONF.auth.api_url
@@ -57,6 +59,8 @@ class CorsMiddleware(object):
# Public API URL
origins.add(public_api_url)
+ origins = list(origins)
+
if origin:
if '*' in origins:
origin_allowed = origin
