content-type to allowedHeadersArr

[popmanhe]

When using browser(chrow, firefox) to request a resource from IPFS, browser uses a preflight request with content-type header. So without content-type in the allowed list, the request will fail.

[Stebalien]

This shouldn't be necessary according to the second paragraph here: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Headers

[popmanhe]

This shouldn't be necessary according to the second paragraph here: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Headers

I am developing a web site. and from that web site, there is a request that links to a IPFS gateway. So it is a CORS request. But without content-type added to the allowed header in IPFS config, the request fails.

The following message is from Chrome. It's the same in firefox.

Access to fetch at 'http://localhost:8080/ipfs/QmYwdHKn3bGePULMqhqmTiM2JjQPEc8sYwEuDYDaa2DP6r' from origin 'http://localhost:3000' has been blocked by CORS policy: Request header field content-type is not allowed by Access-Control-Allow-Headers in preflight response.

[Stebalien]

Suggested change

	"content-type"
	"Content-Type",

(to be consistent)

[Stebalien]

Also needs to end with a comma.

[Stebalien]

Ah, I see. That only applies to form data and text. I assume you're trying to write to a writable gateway, right?

@lidel or @hsanjuan you both know more about this than I do, does this look correct? That is, should users be able to POST with arbitrary content types to a writable gateway. As far as I can tell, the answer is yes.

[popmanhe]

No. It's just a GET request. Just it's a CORS request.
I am using brower's native fetch method to get the content from IPFS gateway
const response = await fetch(url, {
headers,
mode: 'cors',
method: "GET"
});

[Stebalien]

Wait, are you passing a Content-Type header?

[hsanjuan]

I don't see anything wrong with this PR. The gateway sets correct Content-Type headers (well, http.ServeContent does). However, in Chrome these are probably not visible in Ajax requests because they are not part of the Access-Control-Expose-Headers (I think Firefox did not care about these things last time I looked). As a side effect this will also put them in Allow-Headers but that should be ok too.

So LGTM (after the small consistency change).

[hsanjuan]

Also, might kill this one too #5138

[Stebalien]

I'm going fix this all at once in #5893.

[Stebalien]

@popmanhe thanks for finding this.