🐞 Cors plugin behaves oddly

[securisec]

Fiber version/commit
0.9.6
cors version: 0.0.3

This bug could be a user error. I cannot replicate this issue in the example code, which is a very small app, but in my project app, which is bigger, with an spa, I am running into the issue.

Issue description
The cors plugin does not seem to propagate throughout the app instance. But if i set the cors header inside the another.go file, then it seems to work.

Expected behavior
Cors is allowed in all the routes available in the app

Steps to reproduce
See code snippet. The route under /api/something does not return the cors headers, but /something does.

Code snippet
main.go

package main

import (
	"github.com/gofiber/cors"
	"github.com/gofiber/fiber"
)

var app *fiber.App

func main() {
	app = fiber.New()
	app.Use(cors.New(cors.Config{
		AllowOrigins: []string{"http://localhost:8080"},
	}))
	app.Get("/abc", func(c *fiber.Ctx) {
		c.SendStatus(302)
	})
	apiFunc()
	app.Listen(3000)
}

another.go

package main

import "github.com/gofiber/fiber"

func apiFunc() {
	app.Get("/api/abc", func(c *fiber.Ctx) {
		c.SendStatus(201)
	})
} 

Again, as mentioned before, I cannot replicate the issue with this example code, but in my main app, which has about 15 routes, but a very similar in structure. One of the main difference between my project, and the code snippet is that i am using the compression, logger and recover middlewares, along with serving an spa (compiled) from some routes.

Second issue
Second issue with Cors:

A second issue is that when am origin is being specified, the origin is just blank, but if it set to *, then it shows *

app.Use(cors.New(cors.Config{
		AllowOrigins: []string{"http://localhost:8080"},
	}))

Test:
http -p h :3000

HTTP/1.1 201 Created
Access-Control-Allow-Origin:
Content-Length: 7
Content-Type: text/plain; charset=utf-8
Date: Fri, 22 May 2020 03:38:56 GMT
Vary: Origin

We see that although the origin is being specified, it is blank in the response.

[Fenny]

You need to add the Origin header when using cmd, did you try to make an XHR request in the browser?

curl -H "origin: http://localhost:3000" http://localhost:3000/abc -v
*   Trying ::1...
* TCP_NODELAY set
* Connection failed
* connect to ::1 port 3000 failed: Connection refused
*   Trying 127.0.0.1...
* TCP_NODELAY set
* Connected to localhost (127.0.0.1) port 3000 (#0)
> GET /abc HTTP/1.1
> Host: localhost:3000
> User-Agent: curl/7.64.1
> Accept: */*
> origin: http://localhost:3000
> 
< HTTP/1.1 302 Found
< Date: Thu, 28 May 2020 13:22:25 GMT
< Content-Type: text/plain; charset=utf-8
< Content-Length: 5
< Vary: Origin
< Access-Control-Allow-Origin: http://localhost:3000
<