CORS Header empty

[sebastiangrebe]

I have added cors_plug to my deps.

I inserted the following into my dev.exs config:

config :cors_plug, origin: ["http://localhost:3000"]

I also inserted CORSplug into my endpoint.ex like this before the router:
plug CORSPlug

Still my header is empty. What am I doing wrong?

[sebastiangrebe]

What I discovered now is if I have not configured cors_plug in my config and removed it from the endpoint.ex the "access-control-allow-origin" header shows me "*".
If I insert the configuration though and restart the server the headers are just missing.

[sebastiangrebe]

Ok I misunderstood the documentation.
Only if the Origin header matches the actual one configured in cors_plug the correct headers are even set.

I did not find this part in the documentation though. The Origin can be faked so it is not really more or less secure but of course you do not set the headers needlessly which is good.