Access control is unnecessary

[davidbarratt]

Problem
This library attempts to control access to ensure that the request meets the allowable criteria under the config. However, this isn't necessary because the browser already does this. The most restrictive thing you can do, is doing nothing. CORS is about allowing things, not restricting them.

The preflight cannot even be cached because it has to varied by Access-Control-Request-Headers. However this isn't necessary, the config is the same regardless of what is requested.

Proposed Solution
Remove access checking which is unnecessary and breaks caching by forcing the request to be varied by the Origin.

[barryvdh]

The only case that access needs to be check if you're using both allowCredentials and a wilcard origin. Because this is not supported by the CORS spec, we return that exact origin. But that is probably the only case in which we actually need to check the header (and set Vary: origin)

[barryvdh]

Can you check out #70 ?
I think that solves it while taking into account dynamic Origins for supportsCredentials and patterns.

[davidbarratt]

The only case that access needs to be check if you're using both allowCredentials and a wilcard origin. Because this is not supported by the CORS spec, we return that exact origin. But that is probably the only case in which we actually need to check the header (and set Vary: origin)

This case would always need the origin varried, but it doesn't need to return a failing response. If the preflight doesn't include Access-Control-Allow-Credentials it wont make the request, if it's a simple request, then the response becomes opaque.

Though if the user is specifying a wildcard for the origins, then they wouldn't be able to get to the failed response in the first place becuase they are allowing it for all origins (regardless if the browser supports a response like that).

[barryvdh]

Yeah #70 always adds the Vary header for that case, and checks the origin before setting header. In the other case, no Vary is set and no check is done.