CORS - header in the response must not be the wildcard '*' when the request's credentials mode is 'include

[cameronbraid]

Error reporter in chrome devtools

Access to CSS stylesheet at 'https://..' from origin 'https://...' has been blocked by CORS policy:
 The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard
  '*' when the request's credentials mode is 'include'.
16:11:31.942

So I think the CORS support needs to change from sending * and instead send the origin of the request in the Access-Control-Allow-Origin header

[cameronbraid]

raised an issue upstream go-chi/cors#17

[cameronbraid]

I found a workaround

allowOrigins: [https://*,http://*]
allowCredentials: true

As when you use allowAll: true this causes chi to use * as the header, where as adding a match like this makes it send the request's origin header

[oxyno-zeta]

Hello,

Thanks for this cross issue.
As written in the doc, this feature is based on the go-chi/cors library. I will wait for a response on your other issue to see if I can do anything on S3-Proxy.

I must admit that I've never seen that case.

Regards,

Oxyno-zeta