CORS: reject requests with 401 for non-preflight request with not mat…

…ching origin header (#2732)
labstack · Jan 7, 2025 · ee3e129 · ee3e129
1 parent 45524e3
commit ee3e129
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/middleware/cors.go b/middleware/cors.go
@@ -262,7 +262,7 @@ func CORSWithConfig(config CORSConfig) echo.MiddlewareFunc {
 			// Origin not allowed
 			if allowOrigin == "" {
 				if !preflight {
-					return next(c)
+					return echo.ErrUnauthorized
 				}
 				return c.NoContent(http.StatusNoContent)
 			}

diff --git a/middleware/cors_test.go b/middleware/cors_test.go
@@ -525,7 +525,7 @@ func TestCorsHeaders(t *testing.T) {
 			allowedOrigin: "http://example.com",
 			method:        http.MethodGet,
 			expected:      false,
-			expectStatus:  http.StatusOK,
+			expectStatus:  http.StatusUnauthorized,
 		},
 		{
 			name:          "non-preflight request, allow specific origin, matching origin header = CORS logic done",