fix: Access-Control-Allow-Headers 的值为 * 时会额外包含 Authorization

Author: caixw

.github/workflows/go.yml

@@ -2,18 +2,16 @@ name: Go
 on: [push, pull_request]
 
 jobs:
-
   test:
     name: Test
     runs-on: ${{ matrix.os }}
 
     strategy:
       matrix:
         os: [ubuntu-latest, macOS-latest, windows-latest]
-        go: ['1.22.x', '1.23.x']
+        go: ["1.23.x", "1.24.x"]
 
     steps:
-
       - name: Check out code into the Go module directory
         uses: actions/checkout@v4
 
@@ -30,7 +28,7 @@ jobs:
         run: go test -race -v -coverprofile='coverage.txt' -covermode=atomic ./...
 
       - name: Upload Coverage report
-        uses: codecov/codecov-action@v4
+        uses: codecov/codecov-action@v5
         with:
           token: ${{secrets.CODECOV_TOKEN}}
-          file: ./coverage.txt
+          files: ./coverage.txt

go.mod

@@ -3,9 +3,9 @@ module github.com/issue9/mux/v9
 require (
 	github.com/issue9/assert/v4 v4.3.1
 	github.com/issue9/errwrap v0.3.2
-	github.com/issue9/source v0.11.7
+	github.com/issue9/source v0.12.5
 )
 
-require golang.org/x/mod v0.22.0 // indirect
+require golang.org/x/mod v0.24.0 // indirect
 
-go 1.22.0
+go 1.23.0

go.sum

@@ -2,7 +2,7 @@ github.com/issue9/assert/v4 v4.3.1 h1:dHYODk1yV7j/1baIB6K6UggI4r1Hfuljqic7PaDbwL
 github.com/issue9/assert/v4 v4.3.1/go.mod h1:v7qDRXi7AsaZZNh8eAK2rkLJg5/clztqQGA1DRv9Lv4=
 github.com/issue9/errwrap v0.3.2 h1:7KEme9Pfe75M+sIMcPCn/DV90wjnOcRbO4DXVAHj3Fw=
 github.com/issue9/errwrap v0.3.2/go.mod h1:KcCLuUGiffjooLCUjL89r1cyO8/HT/VRcQrneO53N3A=
-github.com/issue9/source v0.11.7 h1:wyZv2MExD1kem7FGxIy6/iSgDHqNpLox6dAZfP7VzKM=
-github.com/issue9/source v0.11.7/go.mod h1:cmLmHZdgj+ONnGNdnJp++94VKXTszNAD99hAYOC22bU=
-golang.org/x/mod v0.22.0 h1:D4nJWe9zXqHOmWqj4VMOJhvzj7bEZg4wEYa759z1pH4=
-golang.org/x/mod v0.22.0/go.mod h1:6SkKJ3Xj0I0BrPOZoBy3bdMptDDU9oJrpohJ3eWZ1fY=
+github.com/issue9/source v0.12.5 h1:yfp7gZLMGArbpYgn3wEJ6WAXvx2dCknEXUec/+e3WyE=
+github.com/issue9/source v0.12.5/go.mod h1:5nOhQUwAwEjFVeFkY0QJgSEMsmwHxNugO9O4RhfLNH4=
+golang.org/x/mod v0.24.0 h1:ZfthKaKaT4NrhGVZHO1/WDTwGES4De8KtWO0SIbNJMU=
+golang.org/x/mod v0.24.0/go.mod h1:IXM97Txy2VM4PJ3gI61r1YEk/gAj6zAHN3AdZt6S9Ww=

options.go

@@ -1,4 +1,4 @@
-// SPDX-FileCopyrightText: 2014-2024 caixw
+// SPDX-FileCopyrightText: 2014-2025 caixw
 //
 // SPDX-License-Identifier: MIT
 
@@ -221,20 +221,14 @@ func (o *options) sanitize() error {
 }
 
 func (c *cors) sanitize() error {
-	for _, o := range c.Origins {
-		if o == "*" {
-			c.anyOrigins = true
-			break
-		}
+	if slices.Contains(c.Origins, "*") {
+		c.anyOrigins = true
 	}
 	c.deny = len(c.Origins) == 0
 
-	for _, h := range c.AllowHeaders {
-		if h == "*" {
-			c.allowHeadersString = "*"
-			c.anyHeaders = true
-			break
-		}
+	if slices.Contains(c.AllowHeaders, "*") {
+		c.allowHeadersString = "*," + header.Authorization // Firefox 中 * 并不包含 Authorization 报头。
+		c.anyHeaders = true
 	}
 	if c.allowHeadersString == "" && len(c.AllowHeaders) > 0 {
 		c.allowHeadersString = strings.Join(c.AllowHeaders, ",")

options_test.go

@@ -1,4 +1,4 @@
-// SPDX-FileCopyrightText: 2014-2024 caixw
+// SPDX-FileCopyrightText: 2014-2025 caixw
 //
 // SPDX-License-Identifier: MIT
 
@@ -149,7 +149,7 @@ func TestCORS_sanitize(t *testing.T) {
 	}
 	a.NotError(c.sanitize())
 	a.True(c.anyHeaders).
-		Equal(c.allowHeadersString, "*").
+		Equal(c.allowHeadersString, "*,"+header.Authorization).
 		Equal(c.exposedHeadersString, "h1,h2")
 }