Repository: nuveo/prest
Pull request #183 (2017-07-14 05:55:12)

fix cors
Related issue #181 

codecov[bot]: # [Codecov](https://codecov.io/gh/nuveo/prest/pull/183?src=pr&el=h1) Report
> Merging [#183](https://codecov.io/gh/nuveo/prest/pull/183?src=pr&el=desc) into [master](https://codecov.io/gh/nuveo/prest/commit/bf05b75b7711483b0c2da41a0b4b75ffe039074f?src=pr&el=desc) will **not change** coverage.
> The diff coverage is `n/a`.

[![Impacted file tree graph](https://codecov.io/gh/nuveo/prest/pull/183/graphs/tree.svg?width=650&height=150&src=pr&token=eVD9urwIEv)](https://codecov.io/gh/nuveo/prest/pull/183?src=pr&el=tree)

```diff
@@           Coverage Diff           @@
##           master     #183   +/-   ##
=======================================
  Coverage   86.61%   86.61%           
=======================================
  Files          11       11           
  Lines         904      904           
=======================================
  Hits          783      783           
  Misses         84       84           
  Partials       37       37
```



------

[Continue to review full report at Codecov](https://codecov.io/gh/nuveo/prest/pull/183?src=pr&el=continue).
> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta)
> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
> Powered by [Codecov](https://codecov.io/gh/nuveo/prest/pull/183?src=pr&el=footer). Last update [bf05b75...789b85d](https://codecov.io/gh/nuveo/prest/pull/183?src=pr&el=lastupdated). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments).


Patch:
diff --git a/cmd/root.go b/cmd/root.go
index ef14003..319fb49 100644
--- a/cmd/root.go
+++ b/cmd/root.go
@@ -10,7 +10,6 @@ import (
 	"github.com/nuveo/prest/config/router"
 	"github.com/nuveo/prest/controllers"
 	"github.com/nuveo/prest/middlewares"
-	"github.com/rs/cors"
 	"github.com/spf13/cobra"
 	"github.com/urfave/negroni"
 	// postgres driver for migrate
@@ -52,32 +51,20 @@ func Execute() {
 func app() {
 	n := cfgMiddleware.GetApp()
 	r := router.Get()
-
 	r.HandleFunc("/databases", controllers.GetDatabases).Methods("GET")
 	r.HandleFunc("/schemas", controllers.GetSchemas).Methods("GET")
 	r.HandleFunc("/tables", controllers.GetTables).Methods("GET")
 	r.HandleFunc("/_QUERIES/{queriesLocation}/{script}", controllers.ExecuteFromScripts)
 	r.HandleFunc("/{database}/{schema}", controllers.GetTablesByDatabaseAndSchema).Methods("GET")
-
 	crudRoutes := mux.NewRouter().PathPrefix("/").Subrouter().StrictSlash(true)
-
 	crudRoutes.HandleFunc("/{database}/{schema}/{table}", controllers.SelectFromTables).Methods("GET")
 	crudRoutes.HandleFunc("/{database}/{schema}/{table}", controllers.InsertInTables).Methods("POST")
 	crudRoutes.HandleFunc("/{database}/{schema}/{table}", controllers.DeleteFromTable).Methods("DELETE")
 	crudRoutes.HandleFunc("/{database}/{schema}/{table}", controllers.UpdateTable).Methods("PUT", "PATCH")
-
 	r.PathPrefix("/").Handler(negroni.New(
 		middlewares.AccessControl(),
 		negroni.Wrap(crudRoutes),
 	))
-
-	if config.PrestConf.CORSAllowOrigin != nil {
-		c := cors.New(cors.Options{
-			AllowedOrigins: config.PrestConf.CORSAllowOrigin,
-		})
-		n.Use(c)
-	}
-
 	n.UseHandler(r)
 	n.Run(fmt.Sprintf(":%v", config.PrestConf.HTTPPort))
 }
diff --git a/config/middlewares/middlewares.go b/config/middlewares/middlewares.go
index 2238dcd..e0fd62e 100644
--- a/config/middlewares/middlewares.go
+++ b/config/middlewares/middlewares.go
@@ -16,7 +16,7 @@ var (
 	BaseStack = []negroni.Handler{
 		negroni.Handler(negroni.NewRecovery()),
 		negroni.Handler(negroni.NewLogger()),
-		negroni.Handler(middlewares.HandlerSet()),
+		middlewares.HandlerSet(),
 	}
 )
 
@@ -25,7 +25,10 @@ func initApp() {
 		MiddlewareStack = append(MiddlewareStack, BaseStack...)
 	}
 	if !config.PrestConf.Debug {
-		MiddlewareStack = append(MiddlewareStack, negroni.Handler(middlewares.JwtMiddleware(config.PrestConf.JWTKey)))
+		MiddlewareStack = append(MiddlewareStack, middlewares.JwtMiddleware(config.PrestConf.JWTKey))
+	}
+	if config.PrestConf.CORSAllowOrigin != nil {
+		MiddlewareStack = append(MiddlewareStack, middlewares.Cors(config.PrestConf.CORSAllowOrigin))
 	}
 	app = negroni.New(MiddlewareStack...)
 }
diff --git a/middlewares/middlewares.go b/middlewares/middlewares.go
index 033ce21..a86bb75 100644
--- a/middlewares/middlewares.go
+++ b/middlewares/middlewares.go
@@ -4,6 +4,9 @@ import (
 	"fmt"
 	"net/http"
 	"net/http/httptest"
+	"strconv"
+
+	"strings"
 
 	"github.com/auth0/go-jwt-middleware"
 	"github.com/dgrijalva/jwt-go"
@@ -57,3 +60,18 @@ func JwtMiddleware(key string) negroni.Handler {
 	})
 	return negroni.HandlerFunc(jwtMiddleware.HandlerWithNext)
 }
+
+// Cors middleware
+func Cors(origin []string) negroni.Handler {
+	return negroni.HandlerFunc(func(w http.ResponseWriter, r *http.Request, next http.HandlerFunc) {
+		w.Header().Set(headerAllowOrigin, strings.Join(origin, ","))
+		w.Header().Set(headerAllowMethods, strings.Join(defaultAllowMethods, ","))
+		w.Header().Set(headerAllowHeaders, "*")
+		w.Header().Set(headerAllowCredentials, strconv.FormatBool(true))
+		if allowed := checkCors(r, origin); !allowed {
+			w.WriteHeader(http.StatusForbidden)
+			return
+		}
+		next(w, r)
+	})
+}
diff --git a/middlewares/utils.go b/middlewares/utils.go
index 053bb7d..753f1a8 100644
--- a/middlewares/utils.go
+++ b/middlewares/utils.go
@@ -44,14 +44,15 @@ func permissionByMethod(method string) (permission string) {
 }
 
 func renderFormat(w http.ResponseWriter, recorder *httptest.ResponseRecorder, format string) {
+	for key := range recorder.Header() {
+		w.Header().Set(key, recorder.Header().Get(key))
+	}
 	byt, _ := ioutil.ReadAll(recorder.Body)
-
 	if recorder.Code != http.StatusOK {
 		m := make(map[string]string)
 		m["error"] = strings.TrimSpace(string(byt))
 		byt, _ = json.MarshalIndent(m, "", "\t")
 	}
-
 	switch format {
 	case "xml":
 		xmldata, err := j2x.JsonToXml(byt)
@@ -69,3 +70,44 @@ func renderFormat(w http.ResponseWriter, recorder *httptest.ResponseRecorder, fo
 		w.Write(byt)
 	}
 }
+
+var defaultAllowMethods = []string{
+	"GET",
+	"POST",
+	"PUT",
+	"PATCH",
+	"DELETE",
+}
+
+const (
+	headerAllowOrigin      = "Access-Control-Allow-Origin"
+	headerAllowCredentials = "Access-Control-Allow-Credentials"
+	headerAllowHeaders     = "Access-Control-Allow-Headers"
+	headerAllowMethods     = "Access-Control-Allow-Methods"
+	headerOrigin           = "Origin"
+)
+
+func checkCors(r *http.Request, origin []string) (allowed bool) {
+	var mAllowed bool
+	for _, m := range defaultAllowMethods {
+		if m == r.Method {
+			mAllowed = true
+			break
+		}
+	}
+	if !mAllowed {
+		return
+	}
+	org := r.Header.Get(headerOrigin)
+	var oAllowed bool
+	for _, o := range origin {
+		if o == org || o == "*" || org == "*" {
+			oAllowed = true
+			break
+		}
+	}
+	if oAllowed && mAllowed {
+		allowed = true
+	}
+	return
+}
diff --git a/vendor/github.com/rs/cors/LICENSE b/vendor/github.com/rs/cors/LICENSE
deleted file mode 100644
index d8e2df5..0000000
--- a/vendor/github.com/rs/cors/LICENSE
+++ /dev/null
@@ -1,19 +0,0 @@
-Copyright (c) 2014 Olivier Poitrey <rs@dailymotion.com>
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is furnished
-to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-THE SOFTWARE.
diff --git a/vendor/github.com/rs/cors/README.md b/vendor/github.com/rs/cors/README.md
deleted file mode 100644
index 4bf5672..0000000
--- a/vendor/github.com/rs/cors/README.md
+++ /dev/null
@@ -1,99 +0,0 @@
-# Go CORS handler [![godoc](http://img.shields.io/badge/godoc-reference-blue.svg?style=flat)](https://godoc.org/github.com/rs/cors) [![license](http://img.shields.io/badge/license-MIT-red.svg?style=flat)](https://raw.githubusercontent.com/rs/cors/master/LICENSE) [![build](https://img.shields.io/travis/rs/cors.svg?style=flat)](https://travis-ci.org/rs/cors) [![Coverage](http://gocover.io/_badge/github.com/rs/cors)](http://gocover.io/github.com/rs/cors)
-
-CORS is a `net/http` handler implementing [Cross Origin Resource Sharing W3 specification](http://www.w3.org/TR/cors/) in Golang.
-
-## Getting Started
-
-After installing Go and setting up your [GOPATH](http://golang.org/doc/code.html#GOPATH), create your first `.go` file. We'll call it `server.go`.
-
-```go
-package main
-
-import (
-    "net/http"
-
-    "github.com/rs/cors"
-)
-
-func main() {
-    mux := http.NewServeMux()
-    mux.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
-        w.Header().Set("Content-Type", "application/json")
-        w.Write([]byte("{\"hello\": \"world\"}"))
-    })
-
-    // cors.Default() setup the middleware with default options being
-    // all origins accepted with simple methods (GET, POST). See
-    // documentation below for more options.
-    handler := cors.Default().Handler(mux)
-    http.ListenAndServe(":8080", handler)
-}
-```
-
-Install `cors`:
-
-    go get github.com/rs/cors
-
-Then run your server:
-
-    go run server.go
-
-The server now runs on `localhost:8080`:
-
-    $ curl -D - -H 'Origin: http://foo.com' http://localhost:8080/
-    HTTP/1.1 200 OK
-    Access-Control-Allow-Origin: foo.com
-    Content-Type: application/json
-    Date: Sat, 25 Oct 2014 03:43:57 GMT
-    Content-Length: 18
-
-    {"hello": "world"}
-
-### More Examples
-
-* `net/http`: [examples/nethttp/server.go](https://github.com/rs/cors/blob/master/examples/nethttp/server.go)
-* [Goji](https://goji.io): [examples/goji/server.go](https://github.com/rs/cors/blob/master/examples/goji/server.go)
-* [Martini](http://martini.codegangsta.io): [examples/martini/server.go](https://github.com/rs/cors/blob/master/examples/martini/server.go)
-* [Negroni](https://github.com/codegangsta/negroni): [examples/negroni/server.go](https://github.com/rs/cors/blob/master/examples/negroni/server.go)
-* [Alice](https://github.com/justinas/alice): [examples/alice/server.go](https://github.com/rs/cors/blob/master/examples/alice/server.go)
-
-## Parameters
-
-Parameters are passed to the middleware thru the `cors.New` method as follow:
-
-```go
-c := cors.New(cors.Options{
-    AllowedOrigins: []string{"http://foo.com"},
-    AllowCredentials: true,
-})
-
-// Insert the middleware
-handler = c.Handler(handler)
-```
-
-* **AllowedOrigins** `[]string`: A list of origins a cross-domain request can be executed from. If the special `*` value is present in the list, all origins will be allowed. An origin may contain a wildcard (`*`) to replace 0 or more characters (i.e.: `http://*.domain.com`). Usage of wildcards implies a small performance penality. Only one wildcard can be used per origin. The default value is `*`.
-* **AllowOriginFunc** `func (origin string) bool`: A custom function to validate the origin. It take the origin as argument and returns true if allowed or false otherwise. If this option is set, the content of `AllowedOrigins` is ignored
-* **AllowedMethods** `[]string`: A list of methods the client is allowed to use with cross-domain requests. Default value is simple methods (`GET` and `POST`).
-* **AllowedHeaders** `[]string`: A list of non simple headers the client is allowed to use with cross-domain requests.
-* **ExposedHeaders** `[]string`: Indicates which headers are safe to expose to the API of a CORS API specification
-* **AllowCredentials** `bool`: Indicates whether the request can include user credentials like cookies, HTTP authentication or client side SSL certificates. The default is `false`.
-* **MaxAge** `int`: Indicates how long (in seconds) the results of a preflight request can be cached. The default is `0` which stands for no max age.
-* **OptionsPassthrough** `bool`: Instructs preflight to let other potential next handlers to process the `OPTIONS` method. Turn this on if your application handles `OPTIONS`.
-* **Debug** `bool`: Debugging flag adds additional output to debug server side CORS issues.
-
-See [API documentation](http://godoc.org/github.com/rs/cors) for more info.
-
-## Benchmarks
-
-    BenchmarkWithout          20000000    64.6 ns/op      8 B/op    1 allocs/op
-    BenchmarkDefault          3000000      469 ns/op    114 B/op    2 allocs/op
-    BenchmarkAllowedOrigin    3000000      608 ns/op    114 B/op    2 allocs/op
-    BenchmarkPreflight        20000000    73.2 ns/op      0 B/op    0 allocs/op
-    BenchmarkPreflightHeader  20000000    73.6 ns/op      0 B/op    0 allocs/op
-    BenchmarkParseHeaderList  2000000      847 ns/op    184 B/op    6 allocs/op
-    BenchmarkParse…Single     5000000      290 ns/op     32 B/op    3 allocs/op
-    BenchmarkParse…Normalized 2000000      776 ns/op    160 B/op    6 allocs/op
-
-## Licenses
-
-All source code is licensed under the [MIT License](https://raw.github.com/rs/cors/master/LICENSE).
diff --git a/vendor/github.com/rs/cors/cors.go b/vendor/github.com/rs/cors/cors.go
deleted file mode 100644
index 4bb22d8..0000000
--- a/vendor/github.com/rs/cors/cors.go
+++ /dev/null
@@ -1,412 +0,0 @@
-/*
-Package cors is net/http handler to handle CORS related requests
-as defined by http://www.w3.org/TR/cors/
-
-You can configure it by passing an option struct to cors.New:
-
-    c := cors.New(cors.Options{
-        AllowedOrigins: []string{"foo.com"},
-        AllowedMethods: []string{"GET", "POST", "DELETE"},
-        AllowCredentials: true,
-    })
-
-Then insert the handler in the chain:
-
-    handler = c.Handler(handler)
-
-See Options documentation for more options.
-
-The resulting handler is a standard net/http handler.
-*/
-package cors
-
-import (
-	"log"
-	"net/http"
-	"os"
-	"strconv"
-	"strings"
-
-	"github.com/rs/xhandler"
-	"golang.org/x/net/context"
-)
-
-// Options is a configuration container to setup the CORS middleware.
-type Options struct {
-	// AllowedOrigins is a list of origins a cross-domain request can be executed from.
-	// If the special "*" value is present in the list, all origins will be allowed.
-	// An origin may contain a wildcard (*) to replace 0 or more characters
-	// (i.e.: http://*.domain.com). Usage of wildcards implies a small performance penality.
-	// Only one wildcard can be used per origin.
-	// Default value is ["*"]
-	AllowedOrigins []string
-	// AllowOriginFunc is a custom function to validate the origin. It take the origin
-	// as argument and returns true if allowed or false otherwise. If this option is
-	// set, the content of AllowedOrigins is ignored.
-	AllowOriginFunc func(origin string) bool
-	// AllowedMethods is a list of methods the client is allowed to use with
-	// cross-domain requests. Default value is simple methods (GET and POST)
-	AllowedMethods []string
-	// AllowedHeaders is list of non simple headers the client is allowed to use with
-	// cross-domain requests.
-	// If the special "*" value is present in the list, all headers will be allowed.
-	// Default value is [] but "Origin" is always appended to the list.
-	AllowedHeaders []string
-	// ExposedHeaders indicates which headers are safe to expose to the API of a CORS
-	// API specification
-	ExposedHeaders []string
-	// AllowCredentials indicates whether the request can include user credentials like
-	// cookies, HTTP authentication or client side SSL certificates.
-	AllowCredentials bool
-	// MaxAge indicates how long (in seconds) the results of a preflight request
-	// can be cached
-	MaxAge int
-	// OptionsPassthrough instructs preflight to let other potential next handlers to
-	// process the OPTIONS method. Turn this on if your application handles OPTIONS.
-	OptionsPassthrough bool
-	// Debugging flag adds additional output to debug server side CORS issues
-	Debug bool
-}
-
-// Cors http handler
-type Cors struct {
-	// Debug logger
-	Log *log.Logger
-	// Set to true when allowed origins contains a "*"
-	allowedOriginsAll bool
-	// Normalized list of plain allowed origins
-	allowedOrigins []string
-	// List of allowed origins containing wildcards
-	allowedWOrigins []wildcard
-	// Optional origin validator function
-	allowOriginFunc func(origin string) bool
-	// Set to true when allowed headers contains a "*"
-	allowedHeadersAll bool
-	// Normalized list of allowed headers
-	allowedHeaders []string
-	// Normalized list of allowed methods
-	allowedMethods []string
-	// Normalized list of exposed headers
-	exposedHeaders    []string
-	allowCredentials  bool
-	maxAge            int
-	optionPassthrough bool
-}
-
-// New creates a new Cors handler with the provided options.
-func New(options Options) *Cors {
-	c := &Cors{
-		exposedHeaders:    convert(options.ExposedHeaders, http.CanonicalHeaderKey),
-		allowOriginFunc:   options.AllowOriginFunc,
-		allowCredentials:  options.AllowCredentials,
-		maxAge:            options.MaxAge,
-		optionPassthrough: options.OptionsPassthrough,
-	}
-	if options.Debug {
-		c.Log = log.New(os.Stdout, "[cors] ", log.LstdFlags)
-	}
-
-	// Normalize options
-	// Note: for origins and methods matching, the spec requires a case-sensitive matching.
-	// As it may error prone, we chose to ignore the spec here.
-
-	// Allowed Origins
-	if len(options.AllowedOrigins) == 0 {
-		// Default is all origins
-		c.allowedOriginsAll = true
-	} else {
-		c.allowedOrigins = []string{}
-		c.allowedWOrigins = []wildcard{}
-		for _, origin := range options.AllowedOrigins {
-			// Normalize
-			origin = strings.ToLower(origin)
-			if origin == "*" {
-				// If "*" is present in the list, turn the whole list into a match all
-				c.allowedOriginsAll = true
-				c.allowedOrigins = nil
-				c.allowedWOrigins = nil
-				break
-			} else if i := strings.IndexByte(origin, '*'); i >= 0 {
-				// Split the origin in two: start and end string without the *
-				w := wildcard{origin[0:i], origin[i+1 : len(origin)]}
-				c.allowedWOrigins = append(c.allowedWOrigins, w)
-			} else {
-				c.allowedOrigins = append(c.allowedOrigins, origin)
-			}
-		}
-	}
-
-	// Allowed Headers
-	if len(options.AllowedHeaders) == 0 {
-		// Use sensible defaults
-		c.allowedHeaders = []string{"Origin", "Accept", "Content-Type"}
-	} else {
-		// Origin is always appended as some browsers will always request for this header at preflight
-		c.allowedHeaders = convert(append(options.AllowedHeaders, "Origin"), http.CanonicalHeaderKey)
-		for _, h := range options.AllowedHeaders {
-			if h == "*" {
-				c.allowedHeadersAll = true
-				c.allowedHeaders = nil
-				break
-			}
-		}
-	}
-
-	// Allowed Methods
-	if len(options.AllowedMethods) == 0 {
-		// Default is spec's "simple" methods
-		c.allowedMethods = []string{"GET", "POST"}
-	} else {
-		c.allowedMethods = convert(options.AllowedMethods, strings.ToUpper)
-	}
-
-	return c
-}
-
-// Default creates a new Cors handler with default options
-func Default() *Cors {
-	return New(Options{})
-}
-
-// Handler apply the CORS specification on the request, and add relevant CORS headers
-// as necessary.
-func (c *Cors) Handler(h http.Handler) http.Handler {
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.Method == "OPTIONS" {
-			c.logf("Handler: Preflight request")
-			c.handlePreflight(w, r)
-			// Preflight requests are standalone and should stop the chain as some other
-			// middleware may not handle OPTIONS requests correctly. One typical example
-			// is authentication middleware ; OPTIONS requests won't carry authentication
-			// headers (see #1)
-			if c.optionPassthrough {
-				h.ServeHTTP(w, r)
-			} else {
-				w.WriteHeader(http.StatusOK)
-			}
-		} else {
-			c.logf("Handler: Actual request")
-			c.handleActualRequest(w, r)
-			h.ServeHTTP(w, r)
-		}
-	})
-}
-
-// HandlerC is net/context aware handler
-func (c *Cors) HandlerC(h xhandler.HandlerC) xhandler.HandlerC {
-	return xhandler.HandlerFuncC(func(ctx context.Context, w http.ResponseWriter, r *http.Request) {
-		if r.Method == "OPTIONS" {
-			c.logf("Handler: Preflight request")
-			c.handlePreflight(w, r)
-			// Preflight requests are standalone and should stop the chain as some other
-			// middleware may not handle OPTIONS requests correctly. One typical example
-			// is authentication middleware ; OPTIONS requests won't carry authentication
-			// headers (see #1)
-			if c.optionPassthrough {
-				h.ServeHTTPC(ctx, w, r)
-			} else {
-				w.WriteHeader(http.StatusOK)
-			}
-		} else {
-			c.logf("Handler: Actual request")
-			c.handleActualRequest(w, r)
-			h.ServeHTTPC(ctx, w, r)
-		}
-	})
-}
-
-// HandlerFunc provides Martini compatible handler
-func (c *Cors) HandlerFunc(w http.ResponseWriter, r *http.Request) {
-	if r.Method == "OPTIONS" {
-		c.logf("HandlerFunc: Preflight request")
-		c.handlePreflight(w, r)
-	} else {
-		c.logf("HandlerFunc: Actual request")
-		c.handleActualRequest(w, r)
-	}
-}
-
-// Negroni compatible interface
-func (c *Cors) ServeHTTP(w http.ResponseWriter, r *http.Request, next http.HandlerFunc) {
-	if r.Method == "OPTIONS" {
-		c.logf("ServeHTTP: Preflight request")
-		c.handlePreflight(w, r)
-		// Preflight requests are standalone and should stop the chain as some other
-		// middleware may not handle OPTIONS requests correctly. One typical example
-		// is authentication middleware ; OPTIONS requests won't carry authentication
-		// headers (see #1)
-		if c.optionPassthrough {
-			next(w, r)
-		} else {
-			w.WriteHeader(http.StatusOK)
-		}
-	} else {
-		c.logf("ServeHTTP: Actual request")
-		c.handleActualRequest(w, r)
-		next(w, r)
-	}
-}
-
-// handlePreflight handles pre-flight CORS requests
-func (c *Cors) handlePreflight(w http.ResponseWriter, r *http.Request) {
-	headers := w.Header()
-	origin := r.Header.Get("Origin")
-
-	if r.Method != "OPTIONS" {
-		c.logf("  Preflight aborted: %s!=OPTIONS", r.Method)
-		return
-	}
-	// Always set Vary headers
-	// see https://github.com/rs/cors/issues/10,
-	//     https://github.com/rs/cors/commit/dbdca4d95feaa7511a46e6f1efb3b3aa505bc43f#commitcomment-12352001
-	headers.Add("Vary", "Origin")
-	headers.Add("Vary", "Access-Control-Request-Method")
-	headers.Add("Vary", "Access-Control-Request-Headers")
-
-	if origin == "" {
-		c.logf("  Preflight aborted: empty origin")
-		return
-	}
-	if !c.isOriginAllowed(origin) {
-		c.logf("  Preflight aborted: origin '%s' not allowed", origin)
-		return
-	}
-
-	reqMethod := r.Header.Get("Access-Control-Request-Method")
-	if !c.isMethodAllowed(reqMethod) {
-		c.logf("  Preflight aborted: method '%s' not allowed", reqMethod)
-		return
-	}
-	reqHeaders := parseHeaderList(r.Header.Get("Access-Control-Request-Headers"))
-	if !c.areHeadersAllowed(reqHeaders) {
-		c.logf("  Preflight aborted: headers '%v' not allowed", reqHeaders)
-		return
-	}
-	headers.Set("Access-Control-Allow-Origin", origin)
-	// Spec says: Since the list of methods can be unbounded, simply returning the method indicated
-	// by Access-Control-Request-Method (if supported) can be enough
-	headers.Set("Access-Control-Allow-Methods", strings.ToUpper(reqMethod))
-	if len(reqHeaders) > 0 {
-
-		// Spec says: Since the list of headers can be unbounded, simply returning supported headers
-		// from Access-Control-Request-Headers can be enough
-		headers.Set("Access-Control-Allow-Headers", strings.Join(reqHeaders, ", "))
-	}
-	if c.allowCredentials {
-		headers.Set("Access-Control-Allow-Credentials", "true")
-	}
-	if c.maxAge > 0 {
-		headers.Set("Access-Control-Max-Age", strconv.Itoa(c.maxAge))
-	}
-	c.logf("  Preflight response headers: %v", headers)
-}
-
-// handleActualRequest handles simple cross-origin requests, actual request or redirects
-func (c *Cors) handleActualRequest(w http.ResponseWriter, r *http.Request) {
-	headers := w.Header()
-	origin := r.Header.Get("Origin")
-
-	if r.Method == "OPTIONS" {
-		c.logf("  Actual request no headers added: method == %s", r.Method)
-		return
-	}
-	// Always set Vary, see https://github.com/rs/cors/issues/10
-	headers.Add("Vary", "Origin")
-	if origin == "" {
-		c.logf("  Actual request no headers added: missing origin")
-		return
-	}
-	if !c.isOriginAllowed(origin) {
-		c.logf("  Actual request no headers added: origin '%s' not allowed", origin)
-		return
-	}
-
-	// Note that spec does define a way to specifically disallow a simple method like GET or
-	// POST. Access-Control-Allow-Methods is only used for pre-flight requests and the
-	// spec doesn't instruct to check the allowed methods for simple cross-origin requests.
-	// We think it's a nice feature to be able to have control on those methods though.
-	if !c.isMethodAllowed(r.Method) {
-		c.logf("  Actual request no headers added: method '%s' not allowed", r.Method)
-
-		return
-	}
-	headers.Set("Access-Control-Allow-Origin", origin)
-	if len(c.exposedHeaders) > 0 {
-		headers.Set("Access-Control-Expose-Headers", strings.Join(c.exposedHeaders, ", "))
-	}
-	if c.allowCredentials {
-		headers.Set("Access-Control-Allow-Credentials", "true")
-	}
-	c.logf("  Actual response added headers: %v", headers)
-}
-
-// convenience method. checks if debugging is turned on before printing
-func (c *Cors) logf(format string, a ...interface{}) {
-	if c.Log != nil {
-		c.Log.Printf(format, a...)
-	}
-}
-
-// isOriginAllowed checks if a given origin is allowed to perform cross-domain requests
-// on the endpoint
-func (c *Cors) isOriginAllowed(origin string) bool {
-	if c.allowOriginFunc != nil {
-		return c.allowOriginFunc(origin)
-	}
-	if c.allowedOriginsAll {
-		return true
-	}
-	origin = strings.ToLower(origin)
-	for _, o := range c.allowedOrigins {
-		if o == origin {
-			return true
-		}
-	}
-	for _, w := range c.allowedWOrigins {
-		if w.match(origin) {
-			return true
-		}
-	}
-	return false
-}
-
-// isMethodAllowed checks if a given method can be used as part of a cross-domain request
-// on the endpoing
-func (c *Cors) isMethodAllowed(method string) bool {
-	if len(c.allowedMethods) == 0 {
-		// If no method allowed, always return false, even for preflight request
-		return false
-	}
-	method = strings.ToUpper(method)
-	if method == "OPTIONS" {
-		// Always allow preflight requests
-		return true
-	}
-	for _, m := range c.allowedMethods {
-		if m == method {
-			return true
-		}
-	}
-	return false
-}
-
-// areHeadersAllowed checks if a given list of headers are allowed to used within
-// a cross-domain request.
-func (c *Cors) areHeadersAllowed(requestedHeaders []string) bool {
-	if c.allowedHeadersAll || len(requestedHeaders) == 0 {
-		return true
-	}
-	for _, header := range requestedHeaders {
-		header = http.CanonicalHeaderKey(header)
-		found := false
-		for _, h := range c.allowedHeaders {
-			if h == header {
-				found = true
-			}
-		}
-		if !found {
-			return false
-		}
-	}
-	return true
-}
diff --git a/vendor/github.com/rs/cors/utils.go b/vendor/github.com/rs/cors/utils.go
deleted file mode 100644
index c7a0aa0..0000000
--- a/vendor/github.com/rs/cors/utils.go
+++ /dev/null
@@ -1,70 +0,0 @@
-package cors
-
-import "strings"
-
-const toLower = 'a' - 'A'
-
-type converter func(string) string
-
-type wildcard struct {
-	prefix string
-	suffix string
-}
-
-func (w wildcard) match(s string) bool {
-	return len(s) >= len(w.prefix+w.suffix) && strings.HasPrefix(s, w.prefix) && strings.HasSuffix(s, w.suffix)
-}
-
-// convert converts a list of string using the passed converter function
-func convert(s []string, c converter) []string {
-	out := []string{}
-	for _, i := range s {
-		out = append(out, c(i))
-	}
-	return out
-}
-
-// parseHeaderList tokenize + normalize a string containing a list of headers
-func parseHeaderList(headerList string) []string {
-	l := len(headerList)
-	h := make([]byte, 0, l)
-	upper := true
-	// Estimate the number headers in order to allocate the right splice size
-	t := 0
-	for i := 0; i < l; i++ {
-		if headerList[i] == ',' {
-			t++
-		}
-	}
-	headers := make([]string, 0, t)
-	for i := 0; i < l; i++ {
-		b := headerList[i]
-		if b >= 'a' && b <= 'z' {
-			if upper {
-				h = append(h, b-toLower)
-			} else {
-				h = append(h, b)
-			}
-		} else if b >= 'A' && b <= 'Z' {
-			if !upper {
-				h = append(h, b+toLower)
-			} else {
-				h = append(h, b)
-			}
-		} else if b == '-' || b == '_' || (b >= '0' && b <= '9') {
-			h = append(h, b)
-		}
-
-		if b == ' ' || b == ',' || i == l-1 {
-			if len(h) > 0 {
-				// Flush the found header
-				headers = append(headers, string(h))
-				h = h[:0]
-				upper = true
-			}
-		} else {
-			upper = b == '-' || b == '_'
-		}
-	}
-	return headers
-}
diff --git a/vendor/github.com/rs/xhandler/LICENSE b/vendor/github.com/rs/xhandler/LICENSE
deleted file mode 100644
index 47c5e9d..0000000
--- a/vendor/github.com/rs/xhandler/LICENSE
+++ /dev/null
@@ -1,19 +0,0 @@
-Copyright (c) 2015 Olivier Poitrey <rs@dailymotion.com>
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is furnished
-to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-THE SOFTWARE.
diff --git a/vendor/github.com/rs/xhandler/README.md b/vendor/github.com/rs/xhandler/README.md
deleted file mode 100644
index 91c594b..0000000
--- a/vendor/github.com/rs/xhandler/README.md
+++ /dev/null
@@ -1,134 +0,0 @@
-# XHandler
-
-[![godoc](http://img.shields.io/badge/godoc-reference-blue.svg?style=flat)](https://godoc.org/github.com/rs/xhandler) [![license](http://img.shields.io/badge/license-MIT-red.svg?style=flat)](https://raw.githubusercontent.com/rs/xhandler/master/LICENSE) [![Build Status](https://travis-ci.org/rs/xhandler.svg?branch=master)](https://travis-ci.org/rs/xhandler) [![Coverage](http://gocover.io/_badge/github.com/rs/xhandler)](http://gocover.io/github.com/rs/xhandler)
-
-XHandler is a bridge between [net/context](https://godoc.org/golang.org/x/net/context) and `http.Handler`.
-
-It lets you enforce `net/context` in your handlers without sacrificing compatibility with existing `http.Handlers` nor imposing a specific router.
-
-Thanks to `net/context` deadline management, `xhandler` is able to enforce a per request deadline and will cancel the context when the client closes the connection unexpectedly.
-
-You may create your own `net/context` aware handler pretty much the same way as you would do with http.Handler.
-
-Read more about xhandler on [Dailymotion engineering blog](http://engineering.dailymotion.com/our-way-to-go/).
-
-## Installing
-
-    go get -u github.com/rs/xhandler
-
-## Usage
-
-```go
-package main
-
-import (
-	"log"
-	"net/http"
-	"time"
-
-	"github.com/rs/cors"
-	"github.com/rs/xhandler"
-	"golang.org/x/net/context"
-)
-
-type myMiddleware struct {
-	next xhandler.HandlerC
-}
-
-func (h myMiddleware) ServeHTTPC(ctx context.Context, w http.ResponseWriter, r *http.Request) {
-	ctx = context.WithValue(ctx, "test", "World")
-	h.next.ServeHTTPC(ctx, w, r)
-}
-
-func main() {
-	c := xhandler.Chain{}
-
-	// Add close notifier handler so context is cancelled when the client closes
-	// the connection
-	c.UseC(xhandler.CloseHandler)
-
-	// Add timeout handler
-	c.UseC(xhandler.TimeoutHandler(2 * time.Second))
-
-	// Middleware putting something in the context
-	c.UseC(func(next xhandler.HandlerC) xhandler.HandlerC {
-		return myMiddleware{next: next}
-	})
-
-	// Mix it with a non-context-aware middleware handler
-	c.Use(cors.Default().Handler)
-
-	// Final handler (using handlerFuncC), reading from the context
-	xh := xhandler.HandlerFuncC(func(ctx context.Context, w http.ResponseWriter, r *http.Request) {
-		value := ctx.Value("test").(string)
-		w.Write([]byte("Hello " + value))
-	})
-
-	// Bridge context aware handlers with http.Handler using xhandler.Handle()
-	http.Handle("/test", c.Handler(xh))
-
-	if err := http.ListenAndServe(":8080", nil); err != nil {
-		log.Fatal(err)
-	}
-}
-```
-
-### Using xmux
-
-Xhandler comes with an optional context aware [muxer](https://github.com/rs/xmux) forked from [httprouter](https://github.com/julienschmidt/httprouter):
-
-```go
-package main
-
-import (
-	"fmt"
-	"log"
-	"net/http"
-	"time"
-
-	"github.com/rs/xhandler"
-	"github.com/rs/xmux"
-	"golang.org/x/net/context"
-)
-
-func main() {
-	c := xhandler.Chain{}
-
-	// Append a context-aware middleware handler
-	c.UseC(xhandler.CloseHandler)
-
-	// Another context-aware middleware handler
-	c.UseC(xhandler.TimeoutHandler(2 * time.Second))
-
-	mux := xmux.New()
-
-	// Use c.Handler to terminate the chain with your final handler
-	mux.GET("/welcome/:name", xhandler.HandlerFuncC(func(ctx context.Context, w http.ResponseWriter, req *http.Request) {
-		fmt.Fprintf(w, "Welcome %s!", xmux.Params(ctx).Get("name"))
-	}))
-
-	if err := http.ListenAndServe(":8080", c.Handler(mux)); err != nil {
-		log.Fatal(err)
-	}
-}
-```
-
-See [xmux](https://github.com/rs/xmux) for more examples.
-
-## Context Aware Middleware
-
-Here is a list of `net/context` aware middleware handlers implementing `xhandler.HandlerC` interface.
-
-Feel free to put up a PR linking your middleware if you have built one:
-
-| Middleware | Author | Description |
-| ---------- | ------ | ----------- |
-| [xmux](https://github.com/rs/xmux) | [Olivier Poitrey](https://github.com/rs) | HTTP request muxer |
-| [xlog](https://github.com/rs/xlog) | [Olivier Poitrey](https://github.com/rs) | HTTP handler logger |
-| [xstats](https://github.com/rs/xstats) | [Olivier Poitrey](https://github.com/rs) | A generic client for service instrumentation |
-| [xaccess](https://github.com/rs/xaccess) | [Olivier Poitrey](https://github.com/rs) | HTTP handler access logger with [xlog](https://github.com/rs/xlog) and [xstats](https://github.com/rs/xstats) |
-| [cors](https://github.com/rs/cors) | [Olivier Poitrey](https://github.com/rs) | [Cross Origin Resource Sharing](http://www.w3.org/TR/cors/) (CORS) support |
-
-## Licenses
-
-All source code is licensed under the [MIT License](https://raw.github.com/rs/xhandler/master/LICENSE).
diff --git a/vendor/github.com/rs/xhandler/chain.go b/vendor/github.com/rs/xhandler/chain.go
deleted file mode 100644
index 3e4bd35..0000000
--- a/vendor/github.com/rs/xhandler/chain.go
+++ /dev/null
@@ -1,121 +0,0 @@
-package xhandler
-
-import (
-	"net/http"
-
-	"golang.org/x/net/context"
-)
-
-// Chain is a helper for chaining middleware handlers together for easier
-// management.
-type Chain []func(next HandlerC) HandlerC
-
-// Add appends a variable number of additional middleware handlers
-// to the middleware chain. Middleware handlers can either be
-// context-aware or non-context aware handlers with the appropriate
-// function signatures.
-func (c *Chain) Add(f ...interface{}) {
-	for _, h := range f {
-		switch v := h.(type) {
-		case func(http.Handler) http.Handler:
-			c.Use(v)
-		case func(HandlerC) HandlerC:
-			c.UseC(v)
-		default:
-			panic("Adding invalid handler to the middleware chain")
-		}
-	}
-}
-
-// With creates a new middleware chain from an existing chain,
-// extending it with additional middleware. Middleware handlers
-// can either be context-aware or non-context aware handlers
-// with the appropriate function signatures.
-func (c *Chain) With(f ...interface{}) *Chain {
-	n := make(Chain, len(*c))
-	copy(n, *c)
-	n.Add(f...)
-	return &n
-}
-
-// UseC appends a context-aware handler to the middleware chain.
-func (c *Chain) UseC(f func(next HandlerC) HandlerC) {
-	*c = append(*c, f)
-}
-
-// Use appends a standard http.Handler to the middleware chain without
-// losing track of the context when inserted between two context aware handlers.
-//
-// Caveat: the f function will be called on each request so you are better off putting
-// any initialization sequence outside of this function.
-func (c *Chain) Use(f func(next http.Handler) http.Handler) {
-	xf := func(next HandlerC) HandlerC {
-		return HandlerFuncC(func(ctx context.Context, w http.ResponseWriter, r *http.Request) {
-			n := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-				next.ServeHTTPC(ctx, w, r)
-			})
-			f(n).ServeHTTP(w, r)
-		})
-	}
-	*c = append(*c, xf)
-}
-
-// Handler wraps the provided final handler with all the middleware appended to
-// the chain and returns a new standard http.Handler instance.
-// The context.Background() context is injected automatically.
-func (c Chain) Handler(xh HandlerC) http.Handler {
-	ctx := context.Background()
-	return c.HandlerCtx(ctx, xh)
-}
-
-// HandlerFC is a helper to provide a function (HandlerFuncC) to Handler().
-//
-// HandlerFC is equivalent to:
-//  c.Handler(xhandler.HandlerFuncC(xhc))
-func (c Chain) HandlerFC(xhf HandlerFuncC) http.Handler {
-	ctx := context.Background()
-	return c.HandlerCtx(ctx, HandlerFuncC(xhf))
-}
-
-// HandlerH is a helper to provide a standard http handler (http.HandlerFunc)
-// to Handler(). Your final handler won't have access to the context though.
-func (c Chain) HandlerH(h http.Handler) http.Handler {
-	ctx := context.Background()
-	return c.HandlerCtx(ctx, HandlerFuncC(func(ctx context.Context, w http.ResponseWriter, r *http.Request) {
-		h.ServeHTTP(w, r)
-	}))
-}
-
-// HandlerF is a helper to provide a standard http handler function
-// (http.HandlerFunc) to Handler(). Your final handler won't have access
-// to the context though.
-func (c Chain) HandlerF(hf http.HandlerFunc) http.Handler {
-	ctx := context.Background()
-	return c.HandlerCtx(ctx, HandlerFuncC(func(ctx context.Context, w http.ResponseWriter, r *http.Request) {
-		hf(w, r)
-	}))
-}
-
-// HandlerCtx wraps the provided final handler with all the middleware appended to
-// the chain and returns a new standard http.Handler instance.
-func (c Chain) HandlerCtx(ctx context.Context, xh HandlerC) http.Handler {
-	return New(ctx, c.HandlerC(xh))
-}
-
-// HandlerC wraps the provided final handler with all the middleware appended to
-// the chain and returns a HandlerC instance.
-func (c Chain) HandlerC(xh HandlerC) HandlerC {
-	for i := len(c) - 1; i >= 0; i-- {
-		xh = c[i](xh)
-	}
-	return xh
-}
-
-// HandlerCF wraps the provided final handler func with all the middleware appended to
-// the chain and returns a HandlerC instance.
-//
-// HandlerCF is equivalent to:
-//  c.HandlerC(xhandler.HandlerFuncC(xhc))
-func (c Chain) HandlerCF(xhc HandlerFuncC) HandlerC {
-	return c.HandlerC(HandlerFuncC(xhc))
-}
diff --git a/vendor/github.com/rs/xhandler/middleware.go b/vendor/github.com/rs/xhandler/middleware.go
deleted file mode 100644
index 7ad8fba..0000000
--- a/vendor/github.com/rs/xhandler/middleware.go
+++ /dev/null
@@ -1,59 +0,0 @@
-package xhandler
-
-import (
-	"net/http"
-	"time"
-
-	"golang.org/x/net/context"
-)
-
-// CloseHandler returns a Handler, cancelling the context when the client
-// connection closes unexpectedly.
-func CloseHandler(next HandlerC) HandlerC {
-	return HandlerFuncC(func(ctx context.Context, w http.ResponseWriter, r *http.Request) {
-		// Cancel the context if the client closes the connection
-		if wcn, ok := w.(http.CloseNotifier); ok {
-			var cancel context.CancelFunc
-			ctx, cancel = context.WithCancel(ctx)
-			defer cancel()
-
-			notify := wcn.CloseNotify()
-			go func() {
-				select {
-				case <-notify:
-					cancel()
-				case <-ctx.Done():
-				}
-			}()
-		}
-
-		next.ServeHTTPC(ctx, w, r)
-	})
-}
-
-// TimeoutHandler returns a Handler which adds a timeout to the context.
-//
-// Child handlers have the responsability of obeying the context deadline and to return
-// an appropriate error (or not) response in case of timeout.
-func TimeoutHandler(timeout time.Duration) func(next HandlerC) HandlerC {
-	return func(next HandlerC) HandlerC {
-		return HandlerFuncC(func(ctx context.Context, w http.ResponseWriter, r *http.Request) {
-			ctx, _ = context.WithTimeout(ctx, timeout)
-			next.ServeHTTPC(ctx, w, r)
-		})
-	}
-}
-
-// If is a special handler that will skip insert the condNext handler only if a condition
-// applies at runtime.
-func If(cond func(ctx context.Context, w http.ResponseWriter, r *http.Request) bool, condNext func(next HandlerC) HandlerC) func(next HandlerC) HandlerC {
-	return func(next HandlerC) HandlerC {
-		return HandlerFuncC(func(ctx context.Context, w http.ResponseWriter, r *http.Request) {
-			if cond(ctx, w, r) {
-				condNext(next).ServeHTTPC(ctx, w, r)
-			} else {
-				next.ServeHTTPC(ctx, w, r)
-			}
-		})
-	}
-}
diff --git a/vendor/github.com/rs/xhandler/xhandler.go b/vendor/github.com/rs/xhandler/xhandler.go
deleted file mode 100644
index bc832cb..0000000
--- a/vendor/github.com/rs/xhandler/xhandler.go
+++ /dev/null
@@ -1,42 +0,0 @@
-// Package xhandler provides a bridge between http.Handler and net/context.
-//
-// xhandler enforces net/context in your handlers without sacrificing
-// compatibility with existing http.Handlers nor imposing a specific router.
-//
-// Thanks to net/context deadline management, xhandler is able to enforce
-// a per request deadline and will cancel the context in when the client close
-// the connection unexpectedly.
-//
-// You may create net/context aware middlewares pretty much the same way as
-// you would with http.Handler.
-package xhandler // import "github.com/rs/xhandler"
-
-import (
-	"net/http"
-
-	"golang.org/x/net/context"
-)
-
-// HandlerC is a net/context aware http.Handler
-type HandlerC interface {
-	ServeHTTPC(context.Context, http.ResponseWriter, *http.Request)
-}
-
-// HandlerFuncC type is an adapter to allow the use of ordinary functions
-// as an xhandler.Handler. If f is a function with the appropriate signature,
-// xhandler.HandlerFuncC(f) is a xhandler.Handler object that calls f.
-type HandlerFuncC func(context.Context, http.ResponseWriter, *http.Request)
-
-// ServeHTTPC calls f(ctx, w, r).
-func (f HandlerFuncC) ServeHTTPC(ctx context.Context, w http.ResponseWriter, r *http.Request) {
-	f(ctx, w, r)
-}
-
-// New creates a conventional http.Handler injecting the provided root
-// context to sub handlers. This handler is used as a bridge between conventional
-// http.Handler and context aware handlers.
-func New(ctx context.Context, h HandlerC) http.Handler {
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		h.ServeHTTPC(ctx, w, r)
-	})
-}
diff --git a/vendor/vendor.json b/vendor/vendor.json
index 1a7c128..3d395d0 100644
--- a/vendor/vendor.json
+++ b/vendor/vendor.json
@@ -218,18 +218,6 @@
 			"revision": "a1f048ba24490f9b0674a67e1ce995d685cddf4a",
 			"revisionTime": "2017-01-16T02:49:11Z"
 		},
-		{
-			"checksumSHA1": "LjPdvMphElL0GOVNQCsmZMVgWIw=",
-			"path": "github.com/rs/cors",
-			"revision": "a62a804a8a009876ca59105f7899938a1349f4b3",
-			"revisionTime": "2016-06-17T23:19:35Z"
-		},
-		{
-			"checksumSHA1": "hCRfPlNpqv8tvVivLzmXsoUOf1c=",
-			"path": "github.com/rs/xhandler",
-			"revision": "ed27b6fd65218132ee50cd95f38474a3d8a2cd12",
-			"revisionTime": "2016-06-18T19:32:21Z"
-		},
 		{
 			"checksumSHA1": "lBehULzb2/kIK3wZ0gz2yNmHq9s=",
 			"path": "github.com/spf13/afero",


Test patch:
diff --git a/config/middlewares/middlewares_test.go b/config/middlewares/middlewares_test.go
index 10600a3..af54572 100644
--- a/config/middlewares/middlewares_test.go
+++ b/config/middlewares/middlewares_test.go
@@ -181,3 +181,163 @@ func appTest() *negroni.Negroni {
 	n.UseHandler(r)
 	return n
 }
+
+func TestCorsGet(t *testing.T) {
+	os.Setenv("PREST_DEBUG", "true")
+	os.Setenv("PREST_CORS_ALLOWORIGIN", "*")
+	os.Setenv("PREST_CONF", "../../testdata/prest.toml")
+	config.Load()
+	app = nil
+	r := router.Get()
+	r.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) { w.Write([]byte("custom route")) })
+	n := GetApp()
+	n.UseHandler(r)
+	server := httptest.NewServer(n)
+	defer server.Close()
+	resp, err := http.Get(server.URL)
+	if err != nil {
+		t.Fatal("expected run without errors but was", err)
+	}
+	if resp.Header.Get("Access-Control-Allow-Origin") != "*" {
+		t.Errorf("expected allow origin *, but got %q", resp.Header.Get("Access-Control-Allow-Origin"))
+	}
+	methods := resp.Header.Get("Access-Control-Allow-Methods")
+	for _, method := range []string{"GET", "POST", "PUT", "PATCH", "DELETE"} {
+		if !strings.Contains(methods, method) {
+			t.Errorf("do not contain %s", method)
+		}
+	}
+	if resp.Request.Method != "GET" {
+		t.Errorf("expected method GET, but got %v", resp.Request.Method)
+	}
+	var body []byte
+	body, err = ioutil.ReadAll(resp.Body)
+	if err != nil {
+		t.Fatal("Expected run without errors but was", err)
+	}
+	if len(body) == 0 {
+		t.Error("body is empty")
+	}
+}
+
+func TestCorsPost(t *testing.T) {
+	os.Setenv("PREST_DEBUG", "true")
+	os.Setenv("PREST_CORS_ALLOWORIGIN", "*")
+	os.Setenv("PREST_CONF", "../../testdata/prest.toml")
+	config.Load()
+	app = nil
+	r := router.Get()
+	r.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) { w.Write([]byte("custom route")) })
+	n := GetApp()
+	n.UseHandler(r)
+	server := httptest.NewServer(n)
+	defer server.Close()
+	resp, err := http.Post(server.URL, "application/json", nil)
+	if err != nil {
+		t.Fatal("expected run without errors but was", err)
+	}
+	if resp.Header.Get("Access-Control-Allow-Origin") != "*" {
+		t.Errorf("expected allow origin *, but got %q", resp.Header.Get("Access-Control-Allow-Origin"))
+	}
+	methods := resp.Header.Get("Access-Control-Allow-Methods")
+	for _, method := range []string{"GET", "POST", "PUT", "PATCH", "DELETE"} {
+		if !strings.Contains(methods, method) {
+			t.Errorf("do not contain %s", method)
+		}
+	}
+	if resp.Request.Method != "POST" {
+		t.Errorf("expected method POST, but got %v", resp.Request.Method)
+	}
+	var body []byte
+	body, err = ioutil.ReadAll(resp.Body)
+	if err != nil {
+		t.Fatal("Expected run without errors but was", err)
+	}
+	if len(body) == 0 {
+		t.Error("body is empty")
+	}
+}
+
+func TestCorsHead(t *testing.T) {
+	os.Setenv("PREST_DEBUG", "true")
+	os.Setenv("PREST_CORS_ALLOWORIGIN", "*")
+	os.Setenv("PREST_CONF", "../../testdata/prest.toml")
+	config.Load()
+	app = nil
+	r := router.Get()
+	r.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) { w.Write([]byte("custom route")) })
+	n := GetApp()
+	n.UseHandler(r)
+	server := httptest.NewServer(n)
+	defer server.Close()
+	client := http.Client{}
+	req, err := http.NewRequest("HEAD", server.URL, nil)
+	if err != nil {
+		t.Fatal("expected run without errors but was", err)
+	}
+	var resp *http.Response
+	resp, err = client.Do(req)
+	if err != nil {
+		t.Fatal("expected run without errors but was", err)
+	}
+	if resp.Header.Get("Access-Control-Allow-Origin") != "*" {
+		t.Errorf("expected allow origin *, but got %q", resp.Header.Get("Access-Control-Allow-Origin"))
+	}
+	methods := resp.Header.Get("Access-Control-Allow-Methods")
+	for _, method := range []string{"GET", "POST", "PUT", "PATCH", "DELETE"} {
+		if !strings.Contains(methods, method) {
+			t.Errorf("do not contain %s", method)
+		}
+	}
+	if resp.Request.Method != "HEAD" {
+		t.Errorf("expected method HEAD, but got %v", resp.Request.Method)
+	}
+	if resp.StatusCode != http.StatusForbidden {
+		t.Errorf("expected status code 403 but got %d", resp.StatusCode)
+	}
+}
+
+func TestCorsAllowOriginNotAll(t *testing.T) {
+	os.Setenv("PREST_DEBUG", "true")
+	os.Setenv("PREST_CONF", "../../testdata/prest.toml")
+	os.Setenv("PREST_CORS_ALLOWORIGIN", "http://127.0.0.1")
+	config.Load()
+	config.PrestConf.CORSAllowOrigin = []string{"http://127.0.0.1"}
+	app = nil
+	r := router.Get()
+	r.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) { w.Write([]byte("custom route")) })
+	n := GetApp()
+	n.UseHandler(r)
+	server := httptest.NewServer(n)
+	defer server.Close()
+	client := http.Client{}
+	req, err := http.NewRequest("POST", server.URL, nil)
+	if err != nil {
+		t.Fatal("expected run without errors but was", err)
+	}
+	req.Header.Set("Origin", "http://127.0.0.1")
+	resp, err := client.Do(req)
+	if err != nil {
+		t.Fatal("expected run without errors but was", err)
+	}
+	if resp.Header.Get("Access-Control-Allow-Origin") != "http://127.0.0.1" {
+		t.Errorf("expected allow origin http://127.0.0.1, but got %q", resp.Header.Get("Access-Control-Allow-Origin"))
+	}
+	methods := resp.Header.Get("Access-Control-Allow-Methods")
+	for _, method := range []string{"GET", "POST", "PUT", "PATCH", "DELETE"} {
+		if !strings.Contains(methods, method) {
+			t.Errorf("do not contain %s", method)
+		}
+	}
+	if resp.Request.Method != "POST" {
+		t.Errorf("expected method POST, but got %v", resp.Request.Method)
+	}
+	var body []byte
+	body, err = ioutil.ReadAll(resp.Body)
+	if err != nil {
+		t.Fatal("Expected run without errors but was", err)
+	}
+	if len(body) == 0 {
+		t.Error("body is empty")
+	}
+}
diff --git a/testdata/prest.toml b/testdata/prest.toml
index d54a7a0..465cad4 100644
--- a/testdata/prest.toml
+++ b/testdata/prest.toml
@@ -70,5 +70,4 @@ restrict = true  # can access only the tables listed below
     [[access.tables]]
     name = "test_group_by_table"
     permissions = ["read"]
-    fields = ["id", "name", "age", "salary"]
-
+    fields = ["id", "name", "age", "salary"]
\ No newline at end of file