Emit traceresponse and Server-Timing trace context response headers

While the request span is recording, TelemetryMiddleware adds
`traceresponse: 00-<trace>-<span>-<flags>` and
`Server-Timing: traceparent;desc="..."` to http.response.start, and appends
`traceresponse` to an existing Access-Control-Expose-Headers (never
overwriting it, never adding one when CORS is off, leaving `*` alone).
Hand-rolled because TraceResponsePropagator lives in
opentelemetry-instrumentation, not the API. No Timing-Allow-Origin, no new
setting.

test_cors now expects "Link, traceresponse", since the test suite always has
a recording provider installed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Alex Garcia 2026-09-15 14:37:55 -07:00
commit 86bdc7515f
5 changed files with 180 additions and 1 deletions

View file

@ -854,7 +854,8 @@ def test_cors(
response.headers["Access-Control-Allow-Headers"]
== "Authorization, Content-Type"
)
assert response.headers["Access-Control-Expose-Headers"] == "Link"
# TelemetryMiddleware appends traceresponse while the suite's provider records.
assert response.headers["Access-Control-Expose-Headers"] == "Link, traceresponse"
assert (
response.headers["Access-Control-Allow-Methods"] == "GET, POST, HEAD, OPTIONS"
)