Description

I have a middleware that dynamically changes the value of "Access-Control-Allow-Origin", but it is always invalid. What's the problem?

How to reproduce

func Cors() gin.HandlerFunc {
    return func(c *gin.Context) {
        origin := c.Request.Header.Get("Origin")
        c.Writer.Header().Set("Access-Control-Allow-Origin", origin)
        c.Writer.Header().Set("Access-Control-Max-Age", "86400")
        c.Writer.Header().Set("Access-Control-Allow-Methods", "POST, GET, OPTIONS, PUT, DELETE, UPDATE")
        c.Writer.Header().Set("Access-Control-Allow-Headers", "Access-Control-Allow-Origin, Origin, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization")
        c.Writer.Header().Set("Access-Control-Expose-Headers", "Content-Length")
        c.Writer.Header().Set("Access-Control-Allow-Credentials", "true")
    }
}

微信图片_20210301161321 b57fab0a475514e3656e981232a5b43 e0ef3bc443fa6d1130bd2f87e335daf

Environment

  • go version: 1.16
  • gin version (or commit ref):1.3.1
  • operating system:windows10

Comment From: tunglv-1933

I'm using the same environment but I don't face the problem above. did u resolve it?

Comment From: a1292999652

I close this question now, the main reason is do not use cookies after cross-domain