rs/cors

AllowCredentials should be true in AllowAll()

mcluseau opened this issue · 1 comments

mcluseau commented

Hi, thanks for this great module :-)

I think there a mismatch at least with the godoc about AllowCredentials, I think it should be true here: https://github.com/rs/cors/blob/master/cors.go#L196

ishveda commented

It is not allowed to have AllowedOrigins set to * with AllowCredentials set to true at the same time.

  • 👍2