From e96b5a8f38f342f670ae87dda247712c58d09f70 Mon Sep 17 00:00:00 2001 From: ZainnQureshii <43629888+ZainnQureshii@users.noreply.github.com> Date: Sun, 18 Oct 2026 13:44:09 +0200 Subject: [PATCH] docs(middleware): correct CORS AllowMethods and AllowHeaders defaults AllowHeaders said an empty list allows no domains; an empty list makes the preflight response reflect Access-Control-Request-Headers. AllowMethods pointed at DefaultCORSConfig, which v5 removed; it now names the fallback methods used when the router sets no Allow header. Co-Authored-By: Claude Opus 5.5 --- middleware/cors.go | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/middleware/cors.go b/middleware/cors.go index b4ddbd7f9..8a330affb 100644 --- a/middleware/cors.go +++ b/middleware/cors.go @@ -60,10 +60,11 @@ type CORSConfig struct { // response header. This header specified the list of methods allowed when // accessing the resource. This is used in response to a preflight request. // - // Optional. Default value DefaultCORSConfig.AllowMethods. + // Optional. // If `allowMethods` is left empty, this middleware will fill for preflight // request `Access-Control-Allow-Methods` header value - // from `Allow` header that echo.Router set into context. + // from `Allow` header that echo.Router set into context, or with + // GET, HEAD, PUT, PATCH, POST, DELETE when the router set none. // // See also: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Methods AllowMethods []string @@ -72,7 +73,8 @@ type CORSConfig struct { // response header. This header is used in response to a preflight request to // indicate which HTTP headers can be used when making the actual request. // - // Optional. Defaults to empty list. No domains allowed for CORS. + // Optional. Defaults to empty list. If empty, the preflight response + // reflects the request's Access-Control-Request-Headers header value. // // See also: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Headers AllowHeaders []string