From 92b9765c54b4a01623dde92326ed9bae5db488f9 Mon Sep 17 00:00:00 2001 From: jub0bs Date: Tue, 1 Sep 2026 13:53:59 +0200 Subject: [PATCH] all: do not allow OPTIONS method in CORS config Contrary to popular belief, listing OPTIONS as an allowed method in a server's CORS configuration is not necessary for CORS preflight to succeed. It is only required if server developers wish to allow clients to make explicit use of that method, e.g. via the following client code: fetch('//example.com', {method: 'OPTIONS'}) This commit drops OPTIONS from the list of allowed methods throughout. --- auth/auth.go | 2 +- auth/auth_test.go | 4 ++-- examples/server/auth-middleware/README.md | 4 ++-- internal/oauthtest/fake_authorization_server.go | 2 +- 4 files changed, 6 insertions(+), 6 deletions(-) diff --git a/auth/auth.go b/auth/auth.go index dc02d7d66..732404c3b 100644 --- a/auth/auth.go +++ b/auth/auth.go @@ -190,7 +190,7 @@ func ProtectedResourceMetadataHandler(metadata *oauthex.ProtectedResourceMetadat // Set CORS headers for cross-origin client discovery. // OAuth metadata is public information, so allowing any origin is safe. w.Header().Set("Access-Control-Allow-Origin", "*") - w.Header().Set("Access-Control-Allow-Methods", "GET, OPTIONS") + w.Header().Set("Access-Control-Allow-Methods", "GET") w.Header().Set("Access-Control-Allow-Headers", "Content-Type") // Handle CORS preflight requests diff --git a/auth/auth_test.go b/auth/auth_test.go index 654ca26b8..49dd363fb 100644 --- a/auth/auth_test.go +++ b/auth/auth_test.go @@ -148,8 +148,8 @@ func TestProtectedResourceMetadataHandler(t *testing.T) { t.Errorf("Access-Control-Allow-Origin = %q, want %q", got, "*") } - if got := rec.Header().Get("Access-Control-Allow-Methods"); got != "GET, OPTIONS" { - t.Errorf("Access-Control-Allow-Methods = %q, want %q", got, "GET, OPTIONS") + if got := rec.Header().Get("Access-Control-Allow-Methods"); got != "GET" { + t.Errorf("Access-Control-Allow-Methods = %q, want %q", got, "GET") } // Validate error response body for disallowed methods diff --git a/examples/server/auth-middleware/README.md b/examples/server/auth-middleware/README.md index 001237c0c..561d05f6c 100644 --- a/examples/server/auth-middleware/README.md +++ b/examples/server/auth-middleware/README.md @@ -246,7 +246,7 @@ import "github.com/rs/cors" c := cors.New(cors.Options{ AllowedOrigins: []string{"https://example.com"}, - AllowedMethods: []string{"GET", "OPTIONS"}, + AllowedMethods: []string{"GET"}, }) http.Handle("/.well-known/oauth-protected-resource", c.Handler(auth.ProtectedResourceMetadataHandler(metadata))) @@ -258,7 +258,7 @@ import "github.com/jub0bs/cors" corsMiddleware, err := cors.NewMiddleware(cors.Config{ Origins: []string{"https://example.com"}, - Methods: []string{"GET", "OPTIONS"}, + Methods: []string{"GET"}, }) http.Handle("/.well-known/oauth-protected-resource", corsMiddleware.Wrap(auth.ProtectedResourceMetadataHandler(metadata))) diff --git a/internal/oauthtest/fake_authorization_server.go b/internal/oauthtest/fake_authorization_server.go index 4cd68264a..1694f81d6 100644 --- a/internal/oauthtest/fake_authorization_server.go +++ b/internal/oauthtest/fake_authorization_server.go @@ -210,7 +210,7 @@ func (s *FakeAuthorizationServer) handleMetadata(w http.ResponseWriter, r *http. } // Set CORS headers for cross-origin client discovery. w.Header().Set("Access-Control-Allow-Origin", "*") - w.Header().Set("Access-Control-Allow-Methods", "GET, OPTIONS") + w.Header().Set("Access-Control-Allow-Methods", "GET") w.Header().Set("Access-Control-Allow-Headers", "Content-Type") // Handle CORS preflight requests