Calling all options even if origin header is not present. Fix #18 - Not setting headers on Koa2 / Node 6.2

[CleberRossi]

Calling all options even if origin header is not present. Fix #18 - Not setting headers on Koa2 / Node 6.2

As Origin header is not set in all fetch. I understand that we need to be able to validade, even if the origin is not present. We are still following https://fetch.spec.whatwg.org/#http-origin but grating headers to be added to response on user needs(Options functions to be called).

I even checked on https://expressjs.com/en/resources/middleware/cors.html and I noticed, so far, that the handlers are called even though the request has no origin, Follow the request:

https://www.rfc-editor.org/rfc/rfc6454#section-7.3

Whenever a user agent issues an HTTP request from a "privacy-
sensitive" context, the user agent MUST send the value "null" in the
Origin header field.

NOTE: This document does not define the notion of a privacy- sensitive context. Applications that generate HTTP requests can designate contexts as privacy-sensitive to impose restrictions on how user agents generate Origin header fields.

Fixes #18

Checklist

• I have ensured my pull request is not behind the main or master branch of the original repository.
• I have rebased all commits where necessary so that reviewing this pull request can be done without having to merge it first.
• I have written a commit message that passes commitlint linting.
• I have ensured that my code changes pass linting tests.
• I have ensured that my code changes pass unit tests.
• I have described my pull request and the reasons for code changes along with context if necessary.

[CleberRossi]

@fengmk2 @ltomes @TyrealHu Hello, If you guys could check this out for me, please. Makin gyou aware because the issue has been open for while.

I intend to fix another problem on Strapi, by resolving this one : strapi/strapi#14357

if you guys can help me, please :)

[CleberRossi]

@dead-horse @ruimarinho Hello, If you guys could check this out for me, please. Makin gyou aware because the issue has been open for while.

I intend to fix another problem on Strapi, by resolving this one : strapi/strapi#14357

if you guys can help me, please :)

[TyrealHu]

I look the cors of express, this module didn't check the requestOrigin(The Access-Control-Allow-Origin will be *, even if the origin of request is null). Should we align with this standard of express? @fengmk2

[fengmk2]

3.4.2

[fengmk2]

@CleberRossi This is a breaking change, I will revert this commit on 3.x and release it in a major version 4.0.0.

[fengmk2]

• @koa/cors@4.0.0