CORS no longer works after upgrade to V4

[ilovelili]

Issue Description

We upgraded to echo V4 and found the 'Access-Control-Allow-Origin' response header no longer exists. The CORS example code however seems to be the same with V3. Is there any extra config needed in V4?

Checklist

• [o] Dependencies installed
• [o] No typos
• [o] Searched existing issues and docs

Expected behaviour

'Access-Control-Allow-Origin' should show as response header

Actual behaviour

'Access-Control-Allow-Origin' not shown any more

Steps to reproduce

Working code to debug

package main

import (
	"net/http"
	"os"
	"strings"

	"github.com/labstack/echo/v4"
	"github.com/labstack/echo/v4/middleware"
)

func main() {
	// Echo instance
	e := echo.New()

	e.HideBanner = true

	aos := []string{"*"}
	if os.Getenv("WS_ALLOW_ORIGINS") != "" {
		aos = strings.Split(os.Getenv("WS_ALLOW_ORIGINS"), ",")
	}

	cors := middleware.CORSWithConfig(middleware.CORSConfig{
		AllowOrigins: aos,
	})

	e.Use(cors)

	// Routes
	e.GET("/healthz", func(c echo.Context) error {
		return c.NoContent(http.StatusOK)
	})

	// Start server
	e.Logger.Fatal(e.Start(":1323"))
}

Version/commit

4.3.0

[aldas]

Seems to be releated to 871ed9c
See issue description for why it is so now #1668

When Origin header is empty all CORS logic in circumvented.

Some material related to CORS:

• https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS
• https://en.wikipedia.org/wiki/Cross-origin_resource_sharing

[ilovelili]

I see. Thank you very much for your explanation @aldas !