Add Pragma and Cache-Control to Access-Control-Allow-Headers

[fatbattk]

Is your feature request related to a problem? Please describe.

IE 11 caches (304) same requests and the only way to force it not to is by passing the Pragma and Cache-Control headers.
https://stackoverflow.com/questions/45912500/reactjs-ie11-not-making-new-http-request-using-cached-data

However Parse Server's Access-Control-Allow-Headers does not allow both those headers.

Access to fetch at '?limit=1&where=%7B%22testId%22%3A%22012345%22%7D' from origin 'http://localhost:8080' has been blocked by CORS policy: Request header field pragma is not allowed by Access-Control-Allow-Headers in preflight response.

Describe the solution you'd like

Allow more headers to pass, particularly Pragma and Cache-Control.

Describe alternatives you've considered

Add cache-busting params to the request but that is blocked by Parse Server too, which is valid.

[acinader]

@fatbattk would you be willing to open a pr to resolve this?

[fatbattk]

@acinader sure. #5396

[acinader]

@fatbattk thanks for the effort. The pr looks good to me, but I want to be as sure as we can that we aren't introducing an issue.

See this discussion on the fetch project that is relevant: whatwg/fetch#251

The discussion of credentials concerns me.

Could we be allowing malicious caching of credentials in a shared computer setting? There is the session token, master key, etc in the headers. Is this a problem? Its clear from your issue, that the benign use case it prevents is trying to prevent caching.

I would like to do some additional research to try and wrap my head around this.

I apologize for asking you to open a pr and then considering, but it was very helpful to see what you are proposing.