AllowOriginFunc is set, but the content of AllowedOrigins is not ignored

[macbesu]

The last sentence of the following description in the README does not seem to be strict (when AllowCredentials:true is set).

AllowOriginFunc func (origin string) bool: A custom function to validate the origin. It takes the origin as an argument and returns true if allowed, or false otherwise. If this option is set, the content of AllowedOrigins is ignored.

I wrote the following code:

r := gin.Default()

r.Use(cors.New(cors.Options{
  AllowedOrigins: []string{"*"}, // I also wrote other origins
  AllowCredentials: true,
  AllowOriginFunc: func(origin string) bool { // I thought this function can cover AllowedOrigins
    return true
  },
}))

When I made a request to the server, my browser console reported a cross-domain error:

If I comment out AllowedOrigins: []string{"*"}, there will be no problem.

[jub0bs]

This is indeed reproducible in v1.9.0. Contrary to what the doc claims,

If [AllowOriginFunc] is set, the content of AllowedOrigins is ignored.

AllowOriginFunc doesn't take precedence over AllowedOrigins. To see this, add the following test case in TestSpec:

{
  "AllowedOriginsPlusAllowOriginFunc",
  Options{
    AllowedOrigins: []string{"*"},
    AllowOriginFunc: func(origin string) bool {
      return true
    },
  },
  "GET",
  map[string]string{
    "Origin": "http://foobar.com",
  },
  map[string]string{
    "Vary":                        "Origin",
    "Access-Control-Allow-Origin": "http://foobar.com",
  },
  true,
},

It fails:

--- FAIL: TestSpec (0.00s)
    --- FAIL: TestSpec/AllowedOriginsPlusAllowOriginFunc (0.00s)
        --- FAIL: TestSpec/AllowedOriginsPlusAllowOriginFunc/Handler (0.00s)
          cors_test.go:33: Response header "Access-Control-Allow-Origin" = "", want "http://foobar.com"
        --- FAIL: TestSpec/AllowedOriginsPlusAllowOriginFunc/HandlerFunc (0.00s)
            cors_test.go:33: Response header "Access-Control-Allow-Origin" = "", want "http://foobar.com"
        --- FAIL: TestSpec/AllowedOriginsPlusAllowOriginFunc/Negroni (0.00s)
            cors_test.go:33: Response header "Access-Control-Allow-Origin" = "", want "http://foobar.com"