[cors]: allow users to disable preflight caching

cors.go

@@ -17,6 +17,7 @@ type cors struct {
 	allowedOriginValidator OriginValidator
 	exposedHeaders         []string
 	maxAge                 int
+	customMaxAge           bool
 	ignoreOptions          bool
 	allowCredentials       bool
 	optionStatusCode       int
@@ -94,7 +95,7 @@ func (ch *cors) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 			w.Header().Set(corsAllowHeadersHeader, strings.Join(allowedHeaders, ","))
 		}
 
-		if ch.maxAge > 0 {
+		if ch.customMaxAge {
 			w.Header().Set(corsMaxAgeHeader, strconv.Itoa(ch.maxAge))
 		}
 
@@ -295,6 +296,7 @@ func MaxAge(age int) CORSOption {
 			age = 600
 		}
 
+		ch.customMaxAge = true
 		ch.maxAge = age
 		return nil
 	}

cors_test.go

@@ -298,6 +298,50 @@ func TestCORSHandlerMaxAgeForPreflight(t *testing.T) {
 	}
 }
 
+func TestCORSHandlerZeroMaxAgeForPreflight(t *testing.T) {
+	r := newRequest(http.MethodOptions, "http://www.example.com")
+	r.Header.Set("Origin", r.URL.String())
+	r.Header.Set(corsRequestMethodHeader, http.MethodPost)
+
+	rr := httptest.NewRecorder()
+
+	testHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {})
+
+	CORS(MaxAge(0))(testHandler).ServeHTTP(rr, r)
+	resp := rr.Result()
+
+	if got, want := resp.StatusCode, http.StatusOK; got != want {
+		t.Fatalf("bad status: got %v want %v", got, want)
+	}
+
+	header := resp.Header.Get(corsMaxAgeHeader)
+	if got, want := header, "0"; got != want {
+		t.Fatalf("bad header: expected %q to be %q, got %q.", corsMaxAgeHeader, want, got)
+	}
+}
+
+func TestCORSHandlerNoMaxAgeForPreflight(t *testing.T) {
+	r := newRequest(http.MethodOptions, "http://www.example.com")
+	r.Header.Set("Origin", r.URL.String())
+	r.Header.Set(corsRequestMethodHeader, http.MethodPost)
+
+	rr := httptest.NewRecorder()
+
+	testHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {})
+
+	CORS()(testHandler).ServeHTTP(rr, r)
+	resp := rr.Result()
+
+	if got, want := resp.StatusCode, http.StatusOK; got != want {
+		t.Fatalf("bad status: got %v want %v", got, want)
+	}
+
+	header := resp.Header.Get(corsMaxAgeHeader)
+	if header != "" {
+		t.Fatalf("unexpected header %q", corsMaxAgeHeader)
+	}
+}
+
 func TestCORSHandlerAllowedCredentials(t *testing.T) {
 	r := newRequest(http.MethodGet, "http://www.example.com/")
 	r.Header.Set("Origin", r.URL.String())