Repository: ktorio/ktor
File: ktor-server/ktor-server-plugins/ktor-server-cors/common/src/io/ktor/server/plugins/cors/CORS.kt (Kotlin)

Code before:
        }

        val origin = call.request.headers.getAll(HttpHeaders.Origin)?.singleOrNull()

        if (origin == null) {
            LOGGER.info { "${call.request.id()}: Skip CORS handler because request lacks the Origin header" }
            return@onCall
        }

        val checkOrigin = checkOrigin(
            origin,
            call.request,
            allowSameOrigin,
            allowsAnyHost,
            hostsNormalized,
            hostsWithWildcard,
            pluginConfig.hosts,
            originPredicates
        )
        when (checkOrigin) {
            OriginCheckResult.OK -> {
            }

            OriginCheckResult.SkipCORS -> return@onCall
            OriginCheckResult.Failed -> {
                LOGGER.info { "${call.request.id()}: CORS check fails because Origin $origin does not match" }
                call.respondCorsFailed()
                return@onCall
            }
        }

        if (!allowNonSimpleContentTypes) {
            val contentType = call.request.header(HttpHeaders.ContentType)?.let { ContentType.parse(it) }
            if (contentType != null) {
                if (contentType.withoutParameters() !in CORSConfig.CorsSimpleContentTypes) {
                    LOGGER.info {
                        "${call.request.id()}: CORS check fails because the requested content type $contentType " +
                            "is not in the list of the only allowed simple types ${CORSConfig.CorsSimpleContentTypes}"
                    }
                    call.respondCorsFailed()
                    return@onCall
                }
            }
        }

        if (call.request.httpMethod == HttpMethod.Options) {
            LOGGER.info { "${call.request.id()}: Start preflight handler" }
            call.respondPreflight(
                origin,
                methodsListHeaderValue,
                headersList,

Review comment (bug):
The failure scenario is OK with info so we know when illegal access is attempted - we just need to avoid logging on valid scenarios.

Code after:
        }

        val origin = call.request.headers.getAll(HttpHeaders.Origin)?.singleOrNull()

        if (origin == null) {
            LOGGER.trace { "${call.request.id()}: Skip CORS handler because request lacks the Origin header" }
            return@onCall
        }

        val checkOrigin = checkOrigin(
            origin,
            call.request,
            allowSameOrigin,
            allowsAnyHost,
            hostsNormalized,
            hostsWithWildcard,
            pluginConfig.hosts,
            originPredicates
        )
        when (checkOrigin) {
            OriginCheckResult.OK -> {
            }

            OriginCheckResult.SkipCORS -> return@onCall
            OriginCheckResult.Failed -> {
                LOGGER.trace { "${call.request.id()}: CORS check fails because Origin $origin does not match" }
                call.respondCorsFailed()
                return@onCall
            }
        }

        if (!allowNonSimpleContentTypes) {
            val contentType = call.request.header(HttpHeaders.ContentType)?.let { ContentType.parse(it) }
            if (contentType != null) {
                if (contentType.withoutParameters() !in CORSConfig.CorsSimpleContentTypes) {
                    LOGGER.trace {
                        "${call.request.id()}: CORS check fails because the requested content type $contentType " +
                            "is not in the list of the only allowed simple types ${CORSConfig.CorsSimpleContentTypes}"
                    }
                    call.respondCorsFailed()
                    return@onCall
                }
            }
        }

        if (call.request.httpMethod == HttpMethod.Options) {
            LOGGER.trace { "${call.request.id()}: Start preflight handler" }
            call.respondPreflight(
                origin,
                methodsListHeaderValue,
                headersList,