fix(cors): ACAO header was not sent when conf.origins has multiple

changelog/unreleased/kong/fix-cors-wildcard.yml

@@ -0,0 +1,3 @@
+message: "**CORS**: Fixed an issue where the `Access-Control-Allow-Origin` header was not sent when `conf.origins` has multiple entries but includes `*`."
+type: bugfix
+scope: Plugin

kong/plugins/cors/handler.lua

@@ -96,6 +96,11 @@ local function configure_origin(conf, header_filter)
       cached_domains = {}
 
       for _, entry in ipairs(conf.origins) do
+        if entry == "*" then
+          set_header("Access-Control-Allow-Origin", "*")
+          return true
+        end
+
         local domain
         local maybe_regex, _, err = re_find(entry, "[^A-Za-z0-9.:/-]", "jo")
         if err then

spec/03-plugins/13-cors/01-access_spec.lua

@@ -287,6 +287,10 @@ for _, strategy in helpers.each_strategy() do
         hosts = { "cors13.test" },
       })
 
+      local route14 = bp.routes:insert({
+        hosts = { "cors14.test" },
+      })
+
       local mock_upstream = bp.services:insert {
         host = helpers.mock_upstream_hostname,
         port = helpers.mock_upstream_port,
@@ -451,6 +455,15 @@ for _, strategy in helpers.each_strategy() do
         }
       }
 
+      bp.plugins:insert {
+        name = "cors",
+        route = { id = route14.id },
+        config = {
+          preflight_continue = false,
+          origins = { "foo.bar", "*" }
+        }
+      }
+
       bp.plugins:insert {
         name = "cors",
         route = { id = route_timeout.id },
@@ -613,7 +626,7 @@ for _, strategy in helpers.each_strategy() do
         assert.is_nil(res.headers["Vary"])
       end)
 
-      it("gives appropriate defaults when origin is explicitly set to *", function()
+      it("gives appropriate defaults when origin is explicitly set to * and config.credentials=true", function()
         local res = assert(proxy_client:send {
           method  = "OPTIONS",
           headers = {
@@ -633,6 +646,25 @@ for _, strategy in helpers.each_strategy() do
         assert.is_nil(res.headers["Access-Control-Max-Age"])
       end)
 
+      it("gives * wildcard when origin has multiple entries and have * included", function()
+        local res = assert(proxy_client:send {
+          method  = "OPTIONS",
+          headers = {
+            ["Host"]   = "cors14.test",
+            ["Origin"] = "http://www.example.net",
+            ["Access-Control-Request-Method"] = "GET",
+          }
+        })
+        assert.res_status(200, res)
+        assert.equal("0", res.headers["Content-Length"])
+        assert.equal(CORS_DEFAULT_METHODS, res.headers["Access-Control-Allow-Methods"])
+        assert.equal("*", res.headers["Access-Control-Allow-Origin"])
+        assert.is_nil(res.headers["Access-Control-Allow-Headers"])
+        assert.is_nil(res.headers["Access-Control-Expose-Headers"])
+        assert.is_nil(res.headers["Access-Control-Allow-Credentials"])
+        assert.is_nil(res.headers["Access-Control-Max-Age"])
+      end)
+
       it("accepts config options", function()
         local res = assert(proxy_client:send {
           method  = "OPTIONS",
@@ -1032,7 +1064,7 @@ for _, strategy in helpers.each_strategy() do
         assert.equal("Origin", res.headers["Vary"])
       end)
 
-      it("responds with * when config.credentials=false", function()
+      it("responds with * when origin is explicitly set to * and config.credentials=false", function()
         local res = assert(proxy_client:send {
           method  = "GET",
           headers = {
@@ -1046,6 +1078,18 @@ for _, strategy in helpers.each_strategy() do
         assert.is_nil(res.headers["Vary"])
       end)
 
+      it("responds with * when origin has multiple entries and have * included", function()
+        local res = assert(proxy_client:send {
+          method  = "GET",
+          headers = {
+            ["Host"]   = "cors14.test",
+            ["Origin"] = "http://www.example.net"
+          }
+        })
+        assert.res_status(200, res)
+        assert.equals("*", res.headers["Access-Control-Allow-Origin"])
+      end)
+
       it("removes upstream ACAO header when no match is found", function()
         local res = proxy_client:get("/response-headers", {
           query = ngx.encode_args({