CORS Preflight OPTIONS request should return 200 instead of 204

[wbcustc]

Summary

CORS Preflight OPTIONS request should return 200 instead of 204
Actual code here
https://github.com/Kong/kong/blob/master/kong/plugins/cors/handler.lua#L143

Steps To Reproduce

It seems it will only block the GET request. If you set your own header in a GET request, chrome will send a preflight OPTIONS first and get 204 response.
The browser will not continue to send the actual GET request since it's NO_CONTENT.

Possible fix

instead of returning 204, just return 200 with Content-Length header set to 0.
Instructed by this guideline.
https://developer.mozilla.org/en-US/docs/Glossary/Preflight_request

[aslafy-z]

I'd love to take this up if no one works on it.

As this would change the response code, I guess it's a breaking change that has to land into next, right?

[thibaultcha]

Just merged #4029, which will be part of 1.0 (including the upcoming 1.0.0rc4 planned for next week). Thank you for reporting the issue!

[dzmitry-lahoda]

and https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods/OPTIONS 204 ...

[dzmitry-lahoda]

i am here because of asp.net iis kestel, but that is kong with 26k stars...

[thibaultcha]

See my answer in #4029.