bug:

[azura27]

Issue description

Environment

Bug report without environment information will be ignored or closed.

• apisix version (cmd: apisix version):2.0
• OS (cmd: uname -a): centos 7.4
• OpenResty / Nginx version (cmd: nginx -V or openresty -V): 1.17.8.2
• etcd version, if have (cmd: run curl http://127.0.0.1:9090/v1/server_info to get the info from server-info API):3.5
• apisix-dashboard version, if have:
• luarocks version, if the issue is about installation (cmd: luarocks --version):

Minimal test code / Steps to reproduce the issue

Bug report without steps to reproduce will be ignored or closed.

1. set a route with cors open, OPTIONS method support
   2.visit route with OPTIONS method, return response with no allow-control-allow-origin etc. headers

What's the actual result? (including assertion message & call stack if applicable)

response with no allow-control-allow-origin etc. headers

What's the expected result?

response with allow-control-allow-origin etc. headers

For split backend and frontend environment OPTIONS method is used frequently, so return in rewrite stage is not suitable

[spacewander]

set a route with cors open, OPTIONS method support

What's your configuration for this route?

[azura27]

"cors":{"allow_origins":"","expose_headers":"","allow_credential":false,"max_age":5,"allow_headers":"*","allow_methods":"GET,HEAD,PUT,PATCH,POST,OPTIONS"}

[tzssangglass]

I think it's expected behavior, and take a look at this: #1100

source code for cors plugin handling OPTIONS method:

apisix/apisix/plugins/cors.lua

Lines 227 to 231 in 9db2dd2

	function _M.rewrite(conf, ctx)
	if ctx.var.request_method == "OPTIONS" then
	return 200
	end
	end

The OPTIONS method is a preflight request to check if CORS is supported, so the OPTIONS response header should not require the allow-control-allow-origin header.

[spacewander]

@azura27

"cors":{"allow_origins":"","expose_headers":"","allow_credential":false,"max_age":5,"allow_headers":"*","allow_methods":"GET,HEAD,PUT,PATCH,POST,OPTIONS"}

"" is not a valid configuration, which will remove the allow-control-allow-origin header.