feat: add configurable transport-independent CORS policy

2026-09-26 19:53:28 +08:00
parent 9fade3bedb
commit 800974cfff
33 changed files with 1645 additions and 23 deletions
--- a/cors/README.md
+++ b/cors/README.md
@@ -0,0 +1,82 @@
+# 可选 CORS
+
+CORS 控制浏览器能否跨源读取 HTTP 响应。默认关闭；同源反向代理可以保持关闭。模块无 Gin 或具体业务依赖，标准库/native/HTTP2 与自定义 Runner 使用相同 App 接入策略。
+
+## 生成项目只改配置
+
+在既有 `etc/config.yaml` 的 `server` 中加入，无需修改 main、svc 或每条 `.api` 路由：
+
+```yaml
+server:
+  cors:
+    enabled: true
+    allowedOrigins:
+      - https://admin.example.com
+      - https://merchant.example.com
+    allowedMethods: [GET, HEAD, POST, PUT, PATCH, DELETE]
+    allowedHeaders: [Authorization, Content-Type]
+    exposedHeaders: [X-Request-ID, Content-Disposition]
+    allowCredentials: false
+    maxAge: 10m
+```
+
+文件也可显式引用环境变量：`allowedOrigins: ["${WEB_ORIGIN}"]`。一个数组元素代表一个来源，不把逗号分隔环境文本隐式拆成多个来源。JSON/YAML/XML 走同一加载和校验；非法配置定位 `server.cors.allowedOrigins[0]` 等字段、文件及可用环境名/行列，不回显值。
+
+```sh
+go run . -config etc/config.yaml -check-config
+go run ./examples/cors # 在框架源码根目录运行独立示例
+```
+
+## 手写项目与独立 HTTP 服务
+
+```go
+app := omni.New(omni.WithCORS(omni.CORSConfig{
+    Enabled: true,
+    AllowedOrigins: []string{"https://web.example.com"},
+    AllowedMethods: []string{"GET", "POST"},
+    AllowedHeaders: []string{"Authorization", "Content-Type"},
+}))
+```
+
+已有 net/http 服务也可单独使用，不需要创建 App：
+
+```go
+policy, err := cors.New(cors.Config{
+    Enabled: true,
+    AllowedOrigins: []string{"https://web.example.com"},
+})
+if err != nil { return err }
+handler := policy.Wrap(existingHandler)
+```
+
+Config/New/WithCORS 在初始化时校验并快照配置；同一 Policy 可并发复用。`Config.Validate()` 返回 error，直接向 `omni.New` 传非法选项沿用框架初始化 panic 约定；生成项目在创建 App 前已校验。
+
+## 配置规则
+
+| 字段 | 规则 |
+| --- | --- |
+| enabled | 默认 false；关闭时直接使用原 Handler，不添加头、不拦截 OPTIONS |
+| allowedOrigins | 启用时必填。完整 HTTP(S) origin（协议＋主机＋可选端口），无路径、尾斜杠、userinfo、查询或片段。配置中的协议/主机转小写、默认 80/443 端口省略；请求匹配浏览器序列化后的来源 |
+| allowedMethods | 空列表默认 GET、HEAD、POST；填写后使用指定集合。大写方法名，拒绝浏览器禁止的 CONNECT/TRACE/TRACK，不提供方法通配符 |
+| allowedHeaders | 空列表不批准额外预检请求头。Authorization、JSON Content-Type 等按需要列出；名称忽略大小写，不提供通配符 |
+| exposedHeaders | 默认空；额外允许前端 JS 读取的响应头，例如下载文件名用 Content-Disposition。浏览器本来就可读取的安全列表不需重复填写 |
+| allowCredentials | 默认 false；跨源 Cookie 等凭据模式需要显式 true 和具体来源。单纯手动设置 Authorization 头只需列入 allowedHeaders，不必因此开启 Cookie 凭据模式 |
+| maxAge | 浏览器缓存预检结果的时长，必须非负且为整秒；0 不发送该头。浏览器可按自身上限截短 |
+
+公开无凭据 API 可使用唯一来源 `"*"`；与 `allowCredentials: true` 或其他来源并存会报错。此版本只支持 HTTP(S) 来源，拒绝 `null`、子域通配符、正则、file:// 和不透明来源。国际化域名填写浏览器发送的 ASCII/Punycode 形式；IP 使用完整标准形式。不会为匹配来源查询 DNS。
+
+## 预检、错误响应与安全边界
+
+- CORS 位于路由/业务中间件外层。只有 OPTIONS 且同时带 Origin 和 Access-Control-Request-Method 才视为预检；普通 OPTIONS 继续执行项目逻辑。
+- 合法预检返回 **204 空响应**，不进入业务中间件、鉴权、Logic 或业务响应包装。拒绝预检返回 **403 空响应**，不暴露内部原因；两者是协议响应，不受业务“失败也返回 HTTP 200”的设置影响。
+- 预检验证全局来源、方法、请求头策略，不探测路由存在性；通过不代表实际接口一定存在。实际请求仍由路由处理，可返回 404/405。
+- 实际请求继续正常鉴权；来源/方法获准时，正常响应、401/403、404/405、框架恢复的 500 都带 CORS 头，响应体、状态和错误目录不变。协议解析、TLS、网络层过载等在进入 App 前发生的拒绝不由本模块改写。
+- 未获准或没有 Origin 的实际请求仍正常进入业务，只是不添加 CORS 许可头。CORS 不等于身份认证、服务端访问控制或 CSRF 防护；服务端回调仍需项目自己的验签/鉴权。
+- 始终追加并去重 `Vary: Origin`；预检再追加请求方法/请求头的 Vary，保留原有 Vary 与 `*`。不要在下游代码覆盖这些头。代理与应用选择一处负责 CORS，避免重复头或冲突策略。
+- 不包装 ResponseWriter、不读取/缓存 body、不克隆 Request。下载、上传、Flush、Hijack 和请求上下文保留；不增加响应体大小限制或改写统一返回格式。
+- 使用 App、Engine、NewServer 或 Run/ServeContext/RunWith 接入。Router() 暴露底层路由供高级注册，单独拿 Router().ServeHTTP 服务会绕过应用的外层策略。
+- App 内业务日志/指标不统计被提前结束的预检；如需记录全部流量，在 App 外层或代理配置访问日志。不要让全局登录校验挡在 CORS 预检之前。
+
+配置最多 1024 个来源、每个最多 4096 字节；方法/请求头/暴露头各最多 128 个且名称最多 256 字节；预检请求头列表最多 128 项、8192 字节。拒绝 CRLF、歧义的重复 Origin/请求方法及非法 token。WebSocket Origin 校验、Private Network Access 扩展和云桶 CORS 不包含在本模块中，按对应服务配置。
+
+规则依据：[Fetch CORS 协议](https://fetch.spec.whatwg.org/#http-cors-protocol)、[凭据规则](https://fetch.spec.whatwg.org/#cors-protocol-and-credentials)、[缓存规则](https://fetch.spec.whatwg.org/#cors-protocol-and-http-caches)。可运行示例：[examples/cors](../examples/cors/README.md)。
--- a/cors/config.go
+++ b/cors/config.go
@@ -0,0 +1,144 @@
+// Package cors implements optional, transport-independent browser CORS policy.
+// It does not authenticate requests or provide CSRF protection.
+package cors
+
+import (
+	"net"
+	"net/netip"
+	"net/url"
+	"strconv"
+	"strings"
+	"time"
+
+	"git.yuntuo.hk/k2safe/go-omni/internal/configdiag"
+)
+
+// Config is disabled by default. Origins are exact HTTP(S) origins, or a single
+// "*" for public responses without credentials. Patterns and "null" are rejected.
+// Empty methods default to GET, HEAD, POST; empty header lists grant no extra
+// permissions. MaxAge is a nonnegative whole number of seconds; zero omits it.
+type Config struct {
+	Enabled          bool          `json:"enabled"`
+	AllowedOrigins   []string      `json:"allowedOrigins"`
+	AllowedMethods   []string      `json:"allowedMethods"`
+	AllowedHeaders   []string      `json:"allowedHeaders"`
+	ExposedHeaders   []string      `json:"exposedHeaders"`
+	AllowCredentials bool          `json:"allowCredentials"`
+	MaxAge           time.Duration `json:"maxAge"`
+}
+
+func (c Config) Clone() Config {
+	c.AllowedOrigins = append([]string(nil), c.AllowedOrigins...)
+	c.AllowedMethods = append([]string(nil), c.AllowedMethods...)
+	c.AllowedHeaders = append([]string(nil), c.AllowedHeaders...)
+	c.ExposedHeaders = append([]string(nil), c.ExposedHeaders...)
+	return c
+}
+
+// Validate never echoes configured values in diagnostics. Invalid settings are
+// rejected even when disabled; an empty origin list is legal only when disabled.
+func (c Config) Validate() error {
+	if c.Enabled && len(c.AllowedOrigins) == 0 {
+		return configdiag.New("allowedOrigins", "is required when CORS is enabled")
+	}
+	if c.MaxAge < 0 || c.MaxAge%time.Second != 0 {
+		return configdiag.New("maxAge", "must be a nonnegative whole number of seconds")
+	}
+	if len(c.AllowedOrigins) > 1024 {
+		return configdiag.New("allowedOrigins", "must contain at most 1024 entries")
+	}
+	for i, origin := range c.AllowedOrigins {
+		field := "allowedOrigins[" + strconv.Itoa(i) + "]"
+		if origin == "*" {
+			if c.AllowCredentials || len(c.AllowedOrigins) != 1 {
+				return configdiag.New(field, "wildcard requires a single origin entry and allowCredentials=false")
+			}
+		} else if _, ok := normalizeOrigin(origin); !ok {
+			return configdiag.New(field, "must be an HTTP(S) origin without credentials, path, query, fragment or wildcard")
+		}
+	}
+	for _, list := range []struct {
+		name   string
+		values []string
+	}{{"allowedMethods", c.AllowedMethods}, {"allowedHeaders", c.AllowedHeaders}, {"exposedHeaders", c.ExposedHeaders}} {
+		if len(list.values) > 128 {
+			return configdiag.New(list.name, "must contain at most 128 entries")
+		}
+		for i, value := range list.values {
+			field := list.name + "[" + strconv.Itoa(i) + "]"
+			if !token(value) || value == "*" {
+				return configdiag.New(field, "must be an explicit HTTP token, not a wildcard")
+			}
+			if list.name == "allowedMethods" && (value != strings.ToUpper(value) || value == "CONNECT" || value == "TRACE" || value == "TRACK") {
+				return configdiag.New(field, "must be an uppercase browser-allowed HTTP method")
+			}
+		}
+	}
+	return nil
+}
+
+// Normalize configured scheme/host case and default ports once. Request values
+// match serialized browser origins; arbitrary URL prefixes/suffixes never match.
+func normalizeOrigin(origin string) (string, bool) {
+	if len(origin) == 0 || len(origin) > 4096 {
+		return "", false
+	}
+	for _, b := range []byte(origin) {
+		if b <= 32 || b >= 127 || strings.ContainsRune("\\%?#*", rune(b)) {
+			return "", false
+		}
+	}
+	u, err := url.Parse(origin)
+	if err != nil || u.User != nil || u.Opaque != "" || u.Path != "" || u.RawQuery != "" || u.Fragment != "" || u.Host == "" {
+		return "", false
+	}
+	scheme, host := strings.ToLower(u.Scheme), strings.ToLower(u.Hostname())
+	if (scheme != "http" && scheme != "https") || host == "" || strings.HasSuffix(u.Host, ":") {
+		return "", false
+	}
+	if strings.Contains(host, ":") {
+		ip, err := netip.ParseAddr(host)
+		if err != nil || !ip.Is6() || ip.Zone() != "" {
+			return "", false
+		}
+		host = "[" + ip.String() + "]"
+		if ip.Is4In6() {
+			// Browsers serialize mapped IPv4 as hex IPv6 pieces; netip.String
+			// uses a dotted-decimal tail instead.
+			b := ip.As16()
+			host = "[::ffff:" + strconv.FormatUint(uint64(b[12])<<8|uint64(b[13]), 16) + ":" + strconv.FormatUint(uint64(b[14])<<8|uint64(b[15]), 16) + "]"
+		}
+	} else {
+		if strings.ContainsAny(u.Host, "[]") {
+			return "", false
+		}
+		for _, b := range []byte(host) {
+			if !(b >= 'a' && b <= 'z' || b >= '0' && b <= '9' || b == '.' || b == '-') {
+				return "", false
+			}
+		}
+	}
+	port := u.Port()
+	if port != "" {
+		n, err := strconv.Atoi(port)
+		if err != nil || n < 1 || n > 65535 {
+			return "", false
+		}
+		if !(scheme == "https" && n == 443 || scheme == "http" && n == 80) {
+			host = net.JoinHostPort(strings.Trim(host, "[]"), strconv.Itoa(n))
+		}
+	}
+	return scheme + "://" + host, true
+}
+
+func token(s string) bool {
+	if s == "" || len(s) > 256 {
+		return false
+	}
+	for _, b := range []byte(s) {
+		if !(b >= 'a' && b <= 'z' || b >= 'A' && b <= 'Z' || b >= '0' && b <= '9' || strings.ContainsRune("!#$%&'*+-.^_`|~", rune(b))) {
+			return false
+		}
+	}
+	return true
+}
--- a/cors/cors.go
+++ b/cors/cors.go
@@ -0,0 +1,187 @@
+package cors
+
+import (
+	"net/http"
+	"strconv"
+	"strings"
+	"time"
+)
+
+// Policy is immutable after New and safe to share between concurrent requests.
+type Policy struct {
+	enabled, wildcard, credentials                    bool
+	origins, methods, headers                         map[string]struct{}
+	allowMethods, allowHeaders, exposeHeaders, maxAge string
+}
+
+// New validates and snapshots policy. It performs no network or DNS operations.
+func New(c Config) (*Policy, error) {
+	if err := c.Validate(); err != nil {
+		return nil, err
+	}
+	p := &Policy{enabled: c.Enabled, credentials: c.AllowCredentials}
+	if !c.Enabled {
+		return p, nil
+	}
+	p.origins = make(map[string]struct{}, len(c.AllowedOrigins))
+	for _, origin := range c.AllowedOrigins {
+		if origin == "*" {
+			p.wildcard = true
+			continue
+		}
+		normalized, _ := normalizeOrigin(origin)
+		p.origins[normalized] = struct{}{}
+	}
+	methods := c.AllowedMethods
+	if len(methods) == 0 {
+		methods = []string{http.MethodGet, http.MethodHead, http.MethodPost}
+	}
+	p.methods, p.allowMethods = compileList(methods, false)
+	p.headers, p.allowHeaders = compileList(c.AllowedHeaders, true)
+	_, p.exposeHeaders = compileList(c.ExposedHeaders, true)
+	if c.MaxAge > 0 {
+		p.maxAge = strconv.FormatInt(int64(c.MaxAge/time.Second), 10)
+	}
+	return p, nil
+}
+
+func compileList(values []string, header bool) (map[string]struct{}, string) {
+	set := make(map[string]struct{}, len(values))
+	list := make([]string, 0, len(values))
+	for _, value := range values {
+		key := value
+		if header {
+			key = strings.ToLower(value)
+			value = http.CanonicalHeaderKey(value)
+		}
+		if _, exists := set[key]; exists {
+			continue
+		}
+		set[key] = struct{}{}
+		list = append(list, value)
+	}
+	return set, strings.Join(list, ", ")
+}
+
+// Wrap installs CORS outside routing/authentication. Only actual CORS preflights
+// are short-circuited. Actual requests always continue through normal handlers;
+// an unlisted Origin receives no permission to read the response in a browser.
+// The original ResponseWriter, Request and body pass through without buffering.
+func (p *Policy) Wrap(next http.Handler) http.Handler {
+	if next == nil {
+		panic("cors: nil handler")
+	}
+	if p == nil {
+		panic("cors: nil policy")
+	}
+	if !p.enabled {
+		return next
+	}
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		h := w.Header()
+		vary(h, "Origin")
+		origins := r.Header.Values("Origin")
+		// An OPTIONS request without Origin or Access-Control-Request-Method is
+		// ordinary application traffic, including user-defined OPTIONS handlers.
+		requestedMethods := r.Header.Values("Access-Control-Request-Method")
+		preflight := r.Method == http.MethodOptions && len(origins) > 0 && len(requestedMethods) > 0
+		if preflight {
+			vary(h, "Access-Control-Request-Method")
+			vary(h, "Access-Control-Request-Headers")
+		}
+		if len(origins) != 1 || !p.allowsOrigin(origins[0]) {
+			if preflight {
+				w.WriteHeader(http.StatusForbidden)
+				return
+			}
+			next.ServeHTTP(w, r)
+			return
+		}
+		if preflight {
+			if len(requestedMethods) != 1 || !p.allowsMethod(requestedMethods[0]) || !p.allowsHeaders(r.Header.Values("Access-Control-Request-Headers")) {
+				w.WriteHeader(http.StatusForbidden)
+				return
+			}
+			p.allowOrigin(h, origins[0])
+			h.Set("Access-Control-Allow-Methods", p.allowMethods)
+			if p.allowHeaders != "" {
+				h.Set("Access-Control-Allow-Headers", p.allowHeaders)
+			}
+			if p.maxAge != "" {
+				h.Set("Access-Control-Max-Age", p.maxAge)
+			}
+			w.WriteHeader(http.StatusNoContent)
+			return
+		}
+		// Match the actual method too: this grants response access, not permission
+		// to execute a side effect. Authentication/CSRF checks remain in the app.
+		if p.allowsMethod(r.Method) {
+			p.allowOrigin(h, origins[0])
+			if p.exposeHeaders != "" {
+				h.Set("Access-Control-Expose-Headers", p.exposeHeaders)
+			}
+		}
+		next.ServeHTTP(w, r)
+	})
+}
+
+func (p *Policy) allowsOrigin(origin string) bool {
+	if !p.wildcard {
+		_, ok := p.origins[origin]
+		return ok
+	}
+	normalized, ok := normalizeOrigin(origin)
+	return ok && normalized == origin
+}
+func (p *Policy) allowsMethod(method string) bool { _, ok := p.methods[method]; return ok }
+func (p *Policy) allowOrigin(h http.Header, origin string) {
+	if p.wildcard {
+		origin = "*"
+	}
+	h.Set("Access-Control-Allow-Origin", origin)
+	if p.credentials {
+		h.Set("Access-Control-Allow-Credentials", "true")
+	}
+}
+func (p *Policy) allowsHeaders(lines []string) bool {
+	count, size := 0, 0
+	for _, line := range lines {
+		size += len(line)
+		if size > 8192 {
+			return false
+		}
+		// Parse a header list without allocating an attacker-sized split slice.
+		for {
+			name, rest, more := strings.Cut(line, ",")
+			name = strings.Trim(name, " \t")
+			count++
+			if count > 128 || !token(name) {
+				return false
+			}
+			if _, ok := p.headers[strings.ToLower(name)]; !ok {
+				return false
+			}
+			if !more {
+				break
+			}
+			line = rest
+		}
+	}
+	return true
+}
+func vary(h http.Header, name string) {
+	for _, line := range h.Values("Vary") {
+		for {
+			v, rest, more := strings.Cut(line, ",")
+			v = strings.TrimSpace(v)
+			if v == "*" || strings.EqualFold(v, name) {
+				return
+			}
+			if !more {
+				break
+			}
+			line = rest
+		}
+	}
+	h.Add("Vary", name)
+}
--- a/cors/cors_test.go
+++ b/cors/cors_test.go
@@ -0,0 +1,303 @@
+package cors
+
+import (
+	"context"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"reflect"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+)
+
+func exampleConfig() Config {
+	return Config{Enabled: true, AllowedOrigins: []string{"https://admin.example", "https://merchant.example"}, AllowedMethods: []string{"GET", "POST", "DELETE"}, AllowedHeaders: []string{"Authorization", "Content-Type"}, ExposedHeaders: []string{"X-Request-ID", "Content-Disposition"}, MaxAge: 10 * time.Minute}
+}
+
+func TestPolicyPreflightAndActual(t *testing.T) {
+	for _, tc := range []struct {
+		name, method, origin, requestedMethod, requestedHeaders string
+		status                                                  int
+		called, allowed                                         bool
+	}{
+		{"preflight", "OPTIONS", "https://admin.example", "POST", "authorization, CONTENT-TYPE", 204, false, true},
+		{"no request headers", "OPTIONS", "https://admin.example", "DELETE", "", 204, false, true},
+		{"unknown origin", "OPTIONS", "https://other.example", "POST", "authorization", 403, false, false},
+		{"suffix attack", "OPTIONS", "https://admin.example.evil", "POST", "", 403, false, false},
+		{"scheme mismatch", "OPTIONS", "http://admin.example", "POST", "", 403, false, false},
+		{"port mismatch", "OPTIONS", "https://admin.example:444", "POST", "", 403, false, false},
+		{"opaque origin", "OPTIONS", "null", "POST", "", 403, false, false},
+		{"unknown method", "OPTIONS", "https://admin.example", "PATCH", "", 403, false, false},
+		{"case sensitive method", "OPTIONS", "https://admin.example", "post", "", 403, false, false},
+		{"unknown header", "OPTIONS", "https://admin.example", "POST", "X-Internal", 403, false, false},
+		{"trailing empty header", "OPTIONS", "https://admin.example", "POST", "Authorization,", 403, false, false},
+		{"control header", "OPTIONS", "https://admin.example", "POST", "Authorization\r\nX-Evil", 403, false, false},
+		{"duplicate allowed header", "OPTIONS", "https://admin.example", "POST", "Authorization, authorization", 204, false, true},
+		{"oversized list", "OPTIONS", "https://admin.example", "POST", strings.Repeat("Authorization,", 129) + "Authorization", 403, false, false},
+		{"actual error response", "GET", "https://merchant.example", "", "", 401, true, true},
+		{"actual denied origin still authenticates", "POST", "https://other.example", "", "", 401, true, false},
+		{"actual denied method still authenticates", "PUT", "https://admin.example", "", "", 401, true, false},
+		{"server callback", "POST", "", "", "", 401, true, false},
+		{"ordinary OPTIONS", "OPTIONS", "https://admin.example", "", "", 401, true, false},
+		{"OPTIONS without Origin", "OPTIONS", "", "POST", "", 401, true, false},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			policy, err := New(exampleConfig())
+			if err != nil {
+				t.Fatal(err)
+			}
+			called := false
+			h := policy.Wrap(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				called = true
+				w.WriteHeader(401)
+				io.WriteString(w, "authentication required")
+			}))
+			r := httptest.NewRequest(tc.method, "http://api.example/resource", nil)
+			if tc.origin != "" {
+				r.Header.Set("Origin", tc.origin)
+			}
+			if tc.requestedMethod != "" {
+				r.Header.Set("Access-Control-Request-Method", tc.requestedMethod)
+			}
+			if tc.requestedHeaders != "" {
+				r.Header.Set("Access-Control-Request-Headers", tc.requestedHeaders)
+			}
+			w := httptest.NewRecorder()
+			w.Header().Add("Vary", "Accept-Encoding")
+			h.ServeHTTP(w, r)
+			if w.Code != tc.status || called != tc.called {
+				t.Fatalf("status=%d called=%v", w.Code, called)
+			}
+			if got := w.Header().Get("Access-Control-Allow-Origin"); (got != "") != tc.allowed || tc.allowed && got != tc.origin {
+				t.Fatal(w.Header())
+			}
+			if !strings.Contains(strings.Join(w.Header().Values("Vary"), ","), "Origin") || !strings.Contains(strings.Join(w.Header().Values("Vary"), ","), "Accept-Encoding") {
+				t.Fatal(w.Header())
+			}
+			if !tc.called {
+				if w.Body.Len() != 0 {
+					t.Fatal("preflight wrapped in business response")
+				}
+				if !strings.Contains(strings.Join(w.Header().Values("Vary"), ","), "Access-Control-Request-Headers") {
+					t.Fatal(w.Header())
+				}
+				if tc.allowed && (w.Header().Get("Access-Control-Max-Age") != "600" || !strings.Contains(w.Header().Get("Access-Control-Allow-Headers"), "Authorization")) {
+					t.Fatal(w.Header())
+				}
+			} else if w.Body.String() != "authentication required" {
+				t.Fatal(w.Body.String())
+			}
+			if tc.called && tc.allowed && w.Header().Get("Access-Control-Expose-Headers") != "X-Request-Id, Content-Disposition" {
+				t.Fatal(w.Header())
+			}
+		})
+	}
+}
+
+func TestPolicyValidation(t *testing.T) {
+	for _, origin := range []string{"https://admin.example/", "https://user:password@admin.example", "null", "https://*.example", "https://admin.example?secret", "https://admin.example#secret", "file://host", "https://host:", "https://host:0", "https://host:65536", "https://host%2eevil", "https://host\r\nX: value", "https://例子.example", "https://[localhost]", "https://[::1%25zone]"} {
+		c := exampleConfig()
+		c.AllowedOrigins = []string{origin}
+		err := c.Validate()
+		if err == nil || strings.Contains(err.Error(), origin) {
+			t.Fatalf("invalid origin accepted or exposed: %q %v", origin, err)
+		}
+	}
+	for _, change := range []func(*Config){
+		func(c *Config) { c.AllowedOrigins = nil },
+		func(c *Config) { c.AllowedOrigins = []string{"*"}; c.AllowCredentials = true },
+		func(c *Config) { c.AllowedOrigins = []string{"*", "https://admin.example"} },
+		func(c *Config) { c.AllowedHeaders = []string{"*"} },
+		func(c *Config) { c.ExposedHeaders = []string{"header\r\n"} },
+		func(c *Config) { c.AllowedMethods = []string{"get"} },
+		func(c *Config) { c.AllowedMethods = []string{"TRACE"} },
+		func(c *Config) { c.MaxAge = -time.Second },
+		func(c *Config) { c.MaxAge = time.Millisecond },
+	} {
+		c := exampleConfig()
+		change(&c)
+		if _, err := New(c); err == nil {
+			t.Fatal(c)
+		}
+	}
+	if err := (Config{}).Validate(); err != nil {
+		t.Fatal(err)
+	}
+	for input, want := range map[string]string{"https://[::ffff:192.0.2.1]": "https://[::ffff:c000:201]", "https://[::ffff:c000:201]": "https://[::ffff:c000:201]", "https://ADMIN.EXAMPLE:443": "https://admin.example", "http://localhost:80": "http://localhost", "http://localhost:8080": "http://localhost:8080", "https://[::1]:443": "https://[::1]", "http://[::1]:8080": "http://[::1]:8080"} {
+		got, ok := normalizeOrigin(input)
+		if !ok || got != want {
+			t.Fatalf("%q => %q %v", input, got, ok)
+		}
+	}
+}
+
+func TestPolicyCredentialsWildcardAndDuplicates(t *testing.T) {
+	for _, credentials := range []bool{false, true} {
+		c := exampleConfig()
+		c.AllowCredentials = credentials
+		if !credentials {
+			c.AllowedOrigins = []string{"*"}
+		}
+		p, _ := New(c)
+		for _, origin := range []string{"https://admin.example", "null", "https://admin.example/path", "https://bad\r\n"} {
+			r := httptest.NewRequest("GET", "/", nil)
+			r.Header.Set("Origin", origin)
+			w := httptest.NewRecorder()
+			p.Wrap(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { w.WriteHeader(200) })).ServeHTTP(w, r)
+			if origin != "https://admin.example" {
+				if w.Header().Get("Access-Control-Allow-Origin") != "" {
+					t.Fatal(w.Header())
+				}
+				continue
+			}
+			want := "*"
+			if credentials {
+				want = origin
+			}
+			if w.Header().Get("Access-Control-Allow-Origin") != want || (w.Header().Get("Access-Control-Allow-Credentials") == "true") != credentials {
+				t.Fatal(w.Header())
+			}
+		}
+	}
+	p, _ := New(exampleConfig())
+	for _, header := range []string{"Origin", "Access-Control-Request-Method"} {
+		r := httptest.NewRequest("OPTIONS", "/", nil)
+		r.Header.Set("Origin", "https://admin.example")
+		r.Header.Set("Access-Control-Request-Method", "POST")
+		r.Header.Add(header, r.Header.Get(header))
+		w := httptest.NewRecorder()
+		p.Wrap(http.HandlerFunc(func(http.ResponseWriter, *http.Request) { t.Fatal("ambiguous preflight reached handler") })).ServeHTTP(w, r)
+		if w.Code != 403 || w.Header().Get("Access-Control-Allow-Origin") != "" {
+			t.Fatal(w.Code, w.Header())
+		}
+	}
+}
+
+func TestPolicyPreservesHTTPAndSnapshot(t *testing.T) {
+	c := exampleConfig()
+	p, _ := New(c)
+	c.AllowedOrigins[0] = "https://evil.example"
+	c.AllowedHeaders[0] = "X-Evil"
+	r := httptest.NewRequest("GET", "/", strings.NewReader("request"))
+	r.Header.Set("Origin", "https://admin.example")
+	type key struct{}
+	r = r.WithContext(context.WithValue(r.Context(), key{}, "kept"))
+	w := httptest.NewRecorder()
+	w.Header().Set("Vary", "Accept-Encoding, origin")
+	next := http.HandlerFunc(func(writer http.ResponseWriter, request *http.Request) {
+		if writer != w || request != r || request.Context().Value(key{}) != "kept" {
+			t.Fatal("HTTP capabilities replaced")
+		}
+		io.WriteString(writer, "chunk")
+		writer.(http.Flusher).Flush()
+	})
+	p.Wrap(next).ServeHTTP(w, r)
+	if !w.Flushed || w.Body.String() != "chunk" || w.Header().Get("Access-Control-Allow-Origin") != "https://admin.example" || len(w.Header().Values("Vary")) != 1 {
+		t.Fatal(w)
+	}
+	for _, prior := range []string{"*", "Accept-Encoding, Origin"} {
+		h := http.Header{"Vary": {prior}}
+		vary(h, "Origin")
+		if !reflect.DeepEqual(h.Values("Vary"), []string{prior}) {
+			t.Fatal(h)
+		}
+	}
+	disabled, _ := New(Config{})
+	if reflect.ValueOf(disabled.Wrap(next)).Pointer() != reflect.ValueOf(next).Pointer() {
+		t.Fatal("disabled policy not passthrough")
+	}
+	var wg sync.WaitGroup
+	h := p.Wrap(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { w.WriteHeader(200) }))
+	for i := 0; i < 32; i++ {
+		wg.Add(1)
+		go func(i int) {
+			defer wg.Done()
+			for j := 0; j < 100; j++ {
+				r := httptest.NewRequest("GET", "/", nil)
+				origin := "https://admin.example"
+				if i%2 == 1 {
+					origin = "https://merchant.example"
+				}
+				r.Header.Set("Origin", origin)
+				w := httptest.NewRecorder()
+				h.ServeHTTP(w, r)
+				if w.Header().Get("Access-Control-Allow-Origin") != origin {
+					t.Error("cross-request origin leak")
+				}
+			}
+		}(i)
+	}
+	wg.Wait()
+}
+
+func FuzzCORSHeaders(f *testing.F) {
+	f.Add("https://admin.example", "POST", "authorization, content-type")
+	f.Add("https://admin.example.evil", "POST", "")
+	f.Add("null", "GET", "\r\n")
+	p, _ := New(exampleConfig())
+	h := p.Wrap(http.HandlerFunc(func(http.ResponseWriter, *http.Request) { panic("preflight reached business") }))
+	f.Fuzz(func(t *testing.T, origin, method, headers string) {
+		r := httptest.NewRequest("OPTIONS", "/", nil)
+		r.Header.Set("Origin", origin)
+		r.Header.Set("Access-Control-Request-Method", method)
+		if headers != "" {
+			r.Header.Set("Access-Control-Request-Headers", headers)
+		}
+		w := httptest.NewRecorder()
+		h.ServeHTTP(w, r)
+		if w.Code != 204 && w.Code != 403 {
+			t.Fatal(w.Code)
+		}
+		if w.Body.Len() != 0 {
+			t.Fatal("unexpected body")
+		}
+		if value := w.Header().Get("Access-Control-Allow-Origin"); value != "" {
+			if value != "https://admin.example" && value != "https://merchant.example" {
+				t.Fatal("untrusted reflection")
+			}
+		}
+	})
+}
+
+type benchmarkWriter struct{ header http.Header }
+
+func (w benchmarkWriter) Header() http.Header         { return w.header }
+func (w benchmarkWriter) Write(p []byte) (int, error) { return len(p), nil }
+func (w benchmarkWriter) WriteHeader(int)             {}
+func BenchmarkCORS(b *testing.B) {
+	for _, mode := range []string{"disabled", "noOrigin", "allowed", "denied", "preflight", "wildcard"} {
+		b.Run(mode, func(b *testing.B) {
+			c := exampleConfig()
+			if mode == "disabled" {
+				c.Enabled = false
+			}
+			if mode == "wildcard" {
+				c.AllowedOrigins = []string{"*"}
+			}
+			p, _ := New(c)
+			h := p.Wrap(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { w.WriteHeader(200) }))
+			r := httptest.NewRequest("GET", "/", nil)
+			r.Header.Set("Origin", "https://admin.example")
+			if mode == "noOrigin" {
+				r.Header.Del("Origin")
+			}
+			if mode == "denied" {
+				r.Header.Set("Origin", "https://other.example")
+			}
+			if mode == "preflight" {
+				r.Method = "OPTIONS"
+				r.Header.Set("Access-Control-Request-Method", "POST")
+				r.Header.Set("Access-Control-Request-Headers", "authorization, content-type")
+			}
+			w := benchmarkWriter{make(http.Header)}
+			b.ReportAllocs()
+			b.ResetTimer()
+			for i := 0; i < b.N; i++ {
+				clear(w.header)
+				h.ServeHTTP(w, r)
+			}
+		})
+	}
+}