Repository: gofiber/fiber
File: middleware/cors/cors.go (Go)

Code before:
				log.Warn("[CORS] 'AllowCredentials' is true. Ensure 'AllowOrigins' is not set to '*' in the configuration.")
			}
		} else {
			// For non-credential requests, it's safe to set to '*' or specific origins
			c.Set(fiber.HeaderAccessControlAllowOrigin, allowOrigin)
		}

		// Set Allow-Headers if not empty
		if allowHeaders != "" {
			c.Set(fiber.HeaderAccessControlAllowHeaders, allowHeaders)
		} else {
			h := c.Get(fiber.HeaderAccessControlRequestHeaders)
			if h != "" {
				c.Set(fiber.HeaderAccessControlAllowHeaders, h)
			}
		}

		// Set MaxAge is set
		if cfg.MaxAge > 0 {
			c.Set(fiber.HeaderAccessControlMaxAge, maxAge)
		} else if cfg.MaxAge < 0 {
			c.Set(fiber.HeaderAccessControlMaxAge, "0")
		}

		// Set Preflight request handling
		if cfg.AllowPrivateNetworkAccess {
			// Set the Access-Control-Allow-Private-Network header to "true"
			c.Set(fiber.HeaderAccessControlAllowPrivateNetwork, "true")
		}

		// Send 204 No Content
		return c.SendStatus(fiber.StatusNoContent)
	}
}


Review comment (bug):
I think this condition is wrong, looking at https://github.com/rs/cors/blob/master/cors.go#L380 they check if the `Request` has the Header set before setting it in the `response`.

Code after:
		// Ommit allowMethods and allowHeaders, only used for pre-flight requests
		if c.Method() != fiber.MethodOptions {
			setCORSHeaders(c, allowOrigin, "", "", exposeHeaders, maxAge, cfg)
			return c.Next()
		}

		// Preflight request
		c.Vary(fiber.HeaderAccessControlRequestMethod)
		c.Vary(fiber.HeaderAccessControlRequestHeaders)
		if cfg.AllowPrivateNetwork && c.Get(fiber.HeaderAccessControlRequestPrivateNetwork) == "true" {
			c.Vary(fiber.HeaderAccessControlRequestPrivateNetwork)
			c.Set(fiber.HeaderAccessControlAllowPrivateNetwork, "true")
		}
		setCORSHeaders(c, allowOrigin, allowMethods, allowHeaders, exposeHeaders, maxAge, cfg)

		// Send 204 No Content
		return c.SendStatus(fiber.StatusNoContent)
	}
}

// Function to set CORS headers
func setCORSHeaders(c fiber.Ctx, allowOrigin, allowMethods, allowHeaders, exposeHeaders, maxAge string, cfg Config) {
	c.Vary(fiber.HeaderOrigin)

	if cfg.AllowCredentials {
		// When AllowCredentials is true, set the Access-Control-Allow-Origin to the specific origin instead of '*'
		if allowOrigin == "*" {
			c.Set(fiber.HeaderAccessControlAllowOrigin, allowOrigin)
			log.Warn("[CORS] 'AllowCredentials' is true, but 'AllowOrigins' cannot be set to '*'.")
		} else if allowOrigin != "" {
			c.Set(fiber.HeaderAccessControlAllowOrigin, allowOrigin)
			c.Set(fiber.HeaderAccessControlAllowCredentials, "true")
		}
	} else if allowOrigin != "" {
		// For non-credential requests, it's safe to set to '*' or specific origins
		c.Set(fiber.HeaderAccessControlAllowOrigin, allowOrigin)
	}

	// Set Allow-Methods if not empty
	if allowMethods != "" {
		c.Set(fiber.HeaderAccessControlAllowMethods, allowMethods)
	}

	// Set Allow-Headers if not empty
	if allowHeaders != "" {
		c.Set(fiber.HeaderAccessControlAllowHeaders, allowHeaders)
	} else {
		h := c.Get(fiber.HeaderAccessControlRequestHeaders)
		if h != "" {
			c.Set(fiber.HeaderAccessControlAllowHeaders, h)
		}