Issue Description
Omitting the Access-Control-Max-Age header from a preflight response leads browsers to cache that response for 5 seconds, whereas including
Access-Control-Max-Age: 0
in a preflight response instructs browsers not to cache that preflight response. However, Echo's CORS middleware ignores that distinction and takes a MaxAge value of 0 as a cue to omit the Access-Control-Max-Age header. Therefore, Echo prevents its users from disabling caching of preflight responses.
Version/commit
v4.10.2
Issue Description
Omitting the
Access-Control-Max-Ageheader from a preflight response leads browsers to cache that response for 5 seconds, whereas includingAccess-Control-Max-Age: 0in a preflight response instructs browsers not to cache that preflight response. However, Echo's CORS middleware ignores that distinction and takes a
MaxAgevalue of0as a cue to omit theAccess-Control-Max-Ageheader. Therefore, Echo prevents its users from disabling caching of preflight responses.Version/commit
v4.10.2