Repository: ktorio/ktor
File: ktor-server/ktor-server-tests/common/test/io/ktor/tests/server/plugins/CORSTest.kt (Kotlin)

Code before:
            assertEquals("https://example.com", response.headers[HttpHeaders.AccessControlAllowOrigin])
        }

        client.options("/test") {
            header(HttpHeaders.Origin, "https://example.com")
            header(HttpHeaders.AccessControlRequestMethod, "PATCH")
        }.let { response ->
            assertEquals(response.status, HttpStatusCode.Forbidden)
        }

        client.options("/other") {
            header(HttpHeaders.Origin, "https://example.com")
            header(HttpHeaders.AccessControlRequestMethod, "PATCH")
        }.let { response ->
            assertEquals(response.status, HttpStatusCode.OK)
            assertEquals(HttpHeaders.Origin, response.headers[HttpHeaders.Vary])
            assertEquals("https://example.com", response.headers[HttpHeaders.AccessControlAllowOrigin])
        }

        client.options("/other") {
            header(HttpHeaders.Origin, "https://example.com")
            header(HttpHeaders.AccessControlRequestMethod, "PUT")
        }.let { response ->
            assertEquals(response.status, HttpStatusCode.Forbidden)
        }
    }

    @Test
    fun preflightPluginInParentHandlesChildRoutes() = testApplication {
        routing {
            route("/outer") {
                cors {
                    anyHost()
                }

                route("/inner1") {
                    route("/inner2") {
                        get {
                            call.respond("OK")
                        }
                    }
                }
            }
        }

        client.options("/outer/inner1/inner2") {
            header(HttpHeaders.Origin, "https://example.com")
            header(HttpHeaders.AccessControlRequestMethod, "GET")
        }.let { response ->
            assertEquals(response.status, HttpStatusCode.OK)
            assertEquals("*", response.headers[HttpHeaders.AccessControlAllowOrigin])

Review comment (suggestion):
this DSL looks like we're going to write routes inside it:
```
cors {
   route("/abc") {}
}
```

Let's think how to design it right

Code after:
            assertEquals(response.status, HttpStatusCode.Forbidden)
        }

        client.options("/other") {
            header(HttpHeaders.Origin, "https://example.com")
            header(HttpHeaders.AccessControlRequestMethod, "PATCH")
        }.let { response ->
            assertEquals(response.status, HttpStatusCode.OK)
            assertEquals(HttpHeaders.Origin, response.headers[HttpHeaders.Vary])
            assertEquals("https://example.com", response.headers[HttpHeaders.AccessControlAllowOrigin])
        }

        client.options("/other") {
            header(HttpHeaders.Origin, "https://example.com")
            header(HttpHeaders.AccessControlRequestMethod, "PUT")
        }.let { response ->
            assertEquals(response.status, HttpStatusCode.Forbidden)
        }
    }

    @Test
    fun preflightPluginInParentHandlesChildRoutes() = testApplication {
        routing {
            route("/outer") {
                install(CORS) {
                    anyHost()
                }

                route("/inner1") {
                    route("/inner2") {
                        get {
                            call.respond("OK")
                        }
                    }
                }
            }
        }

        client.options("/outer/inner1/inner2") {
            header(HttpHeaders.Origin, "https://example.com")
            header(HttpHeaders.AccessControlRequestMethod, "GET")
        }.let { response ->
            assertEquals(response.status, HttpStatusCode.OK)
            assertEquals("*", response.headers[HttpHeaders.AccessControlAllowOrigin])
        }
    }

    @Test
    fun preflightNoEffectWithoutOriginHeader() = testApplication {
        routing {
            install(CORS) {