fix(middleware): set CORS headers before commit

Author: wyf027

middleware/cors.go

@@ -269,9 +269,11 @@ func CORSWithConfig(config CORSConfig) echo.MiddlewareFunc {
 
 			// Simple request
 			if !preflight {
-				err := next(c)
 				// Skip setting CORS headers when an upstream handler (e.g. reverse proxy) already set them.
-				if res.Header().Get(echo.HeaderAccessControlAllowOrigin) == "" {
+				setHeaders := func() {
+					if res.Header().Get(echo.HeaderAccessControlAllowOrigin) != "" {
+						return
+					}
 					res.Header().Add(echo.HeaderVary, echo.HeaderOrigin)
 					res.Header().Set(echo.HeaderAccessControlAllowOrigin, allowOrigin)
 					if config.AllowCredentials {
@@ -281,6 +283,11 @@ func CORSWithConfig(config CORSConfig) echo.MiddlewareFunc {
 						res.Header().Set(echo.HeaderAccessControlExposeHeaders, exposeHeaders)
 					}
 				}
+				res.Before(setHeaders)
+				err := next(c)
+				if !res.Committed {
+					setHeaders()
+				}
 				return err
 			}
 

middleware/cors_test.go

@@ -720,8 +720,11 @@ func TestCORSNoDuplicateHeadersFromUpstream(t *testing.T) {
 	rec := httptest.NewRecorder()
 	proxy.ServeHTTP(rec, req)
 
+	result := rec.Result()
+	defer result.Body.Close()
+
 	assert.Equal(t, http.StatusOK, rec.Code)
-	assert.Equal(t, 1, len(rec.Header()[echo.HeaderAccessControlAllowOrigin]))
-	assert.Equal(t, "*", rec.Header().Get(echo.HeaderAccessControlAllowOrigin))
-	assert.Equal(t, 1, len(rec.Header()[echo.HeaderVary]))
+	assert.Equal(t, 1, len(result.Header[echo.HeaderAccessControlAllowOrigin]))
+	assert.Equal(t, "*", result.Header.Get(echo.HeaderAccessControlAllowOrigin))
+	assert.Equal(t, 1, len(result.Header[echo.HeaderVary]))
 }