add cors headers to oidc proxy (#11450)

Author: adameat

ydb/mvp/oidc_proxy/oidc_proxy_ut.cpp

@@ -560,10 +560,10 @@ Y_UNIT_TEST_SUITE(Mvp) {
             UNIT_ASSERT_STRINGS_EQUAL("true", headers.Get(accessControlAllowCredentials));
 
             UNIT_ASSERT(headers.Has(accessControlAllowHeaders));
-            UNIT_ASSERT_STRINGS_EQUAL("Content-Type,Authorization,Origin,Accept", headers.Get(accessControlAllowHeaders));
+            UNIT_ASSERT_STRINGS_EQUAL("Content-Type,Authorization,Origin,Accept,X-Trace-Verbosity,X-Want-Trace,traceparent", headers.Get(accessControlAllowHeaders));
 
             UNIT_ASSERT(headers.Has(accessControlAllowMethods));
-            UNIT_ASSERT_STRINGS_EQUAL("OPTIONS, GET, POST", headers.Get(accessControlAllowMethods));
+            UNIT_ASSERT_STRINGS_EQUAL("OPTIONS,GET,POST,PUT,DELETE", headers.Get(accessControlAllowMethods));
         }
 
         bool IsAjaxRequest() const override {

ydb/mvp/oidc_proxy/openid_connect.cpp

@@ -50,8 +50,10 @@ void SetCORS(const NHttp::THttpIncomingRequestPtr& request, NHttp::THeadersBuild
     }
     headers->Set("Access-Control-Allow-Origin", origin);
     headers->Set("Access-Control-Allow-Credentials", "true");
-    headers->Set("Access-Control-Allow-Headers", "Content-Type,Authorization,Origin,Accept");
-    headers->Set("Access-Control-Allow-Methods", "OPTIONS, GET, POST");
+    headers->Set("Access-Control-Allow-Headers", "Content-Type,Authorization,Origin,Accept,X-Trace-Verbosity,X-Want-Trace,traceparent");
+    headers->Set("Access-Control-Expose-Headers", "traceresponse,X-Worker-Name");
+    headers->Set("Access-Control-Allow-Methods", "OPTIONS,GET,POST,PUT,DELETE");
+    headers->Set("Allow", "OPTIONS,GET,POST,PUT,DELETE");
 }
 
 TString HmacSHA256(TStringBuf key, TStringBuf data) {