Hi,
I was using the SplashLabs CORS module, but ran into a blocker with it when trying to POST to the guest-cart.
I disabled it and installed your module, added the configs etc etc.

Now I can't even see the initial API GET product request work anymore.
We are using Magento 2.3.3 (commerce) on Magento Cloud - working on Integration instance.

In the exception I see:
[2021-03-09 05:45:50] report.CRITICAL: Request method is invalid. {"report_id":"076a55918ca8c940a9c25f3cc440482a965e1d6ed7b7e24d647dbc8906e6b43d","exception":"[object] (Magento\Framework\Exception\InputException(code: 0): Request method is invalid. at /app/vendor/magento/framework/Webapi/Rest/Request.php:180)"} []

Which closely matched an access log:
193.114.101.142 - - [09/Mar/2021:05:45:50 +0000] "OPTIONS /rest/V1/products?&searchCriteria[filter_groups][0][filters][0][field]=entity_id&searchCriteria[filter_groups][0][filters][0][value]=3019&searchCriteria[filter_groups][0][filters][0][condition_type]=eq HTTP/1.1" 500 501 "https://crv-test5.racingjd.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.190 Safari/537.36"

I notice that in your module your not overriding the ->getHttpMethod() which by default does not recognise OPTIONS method (which is inherently the Magento shortcoming)

Did we miss something in the setup?
The module was active, and cached were flushed after the deployment.. I even tried a few different option variations..

Thnx...

Currently, we only support GraphQL api calls, we can easily extend support to REST API calls by adding some additional configuration.

Currently, we recommend against using the wildcard access-control-allow-origin header, we should explain precisely why.

💡 Feature request

Add Magento 2.4 Support

The Desired Behavior

Installation of this module works with Magento 2.4.

Your Use Case

As a developer I want to use this module in Magento 2.4.

I tried to install this module in the following environment:

magento2-cors version: 1.3.0
Magento version: 2.4.0 
PHP Version version: 7.4.9

and got the following error message:

Problem 1
    - magento/framework 102.0.0 requires php ~7.1.3||~7.2.0 -> your PHP version (7.4.9) does not satisfy that requirement.
    - magento/framework 102.0.1 requires php ~7.1.3||~7.2.0 -> your PHP version (7.4.9) does not satisfy that requirement.
    - magento/framework 102.0.2 requires php ~7.1.3||~7.2.0 -> your PHP version (7.4.9) does not satisfy that requirement.
    - magento/framework 102.0.3 requires php ~7.1.3||~7.2.0||~7.3.0 -> your PHP version (7.4.9) does not satisfy that requirement.
    - magento/framework 102.0.2-p2 requires php ~7.1.3||~7.2.0 -> your PHP version (7.4.9) does not satisfy that requirement.
    - magento/framework 102.0.4 requires php ~7.1.3||~7.2.0||~7.3.0 -> your PHP version (7.4.9) does not satisfy that requirement.
    - magento/framework 102.0.3-p1 requires php ~7.1.3||~7.2.0||~7.3.0 -> your PHP version (7.4.9) does not satisfy that requirement.
    - magento/framework 102.0.5 requires php ~7.1.3||~7.2.0||~7.3.0 -> your PHP version (7.4.9) does not satisfy that requirement.
    - magento/framework 102.0.4-p2 requires php ~7.1.3||~7.2.0||~7.3.0 -> your PHP version (7.4.9) does not satisfy that requirement.
    - magento/framework 102.0.5-p2 requires php ~7.1.3||~7.2.0||~7.3.0 -> your PHP version (7.4.9) does not satisfy that requirement.
    - graycore/magento2-cors 1.3.0 requires magento/framework ^102.0 -> satisfiable by magento/framework[102.0.5-p2, 102.0.4-p2, 102.0.5, 102.0.3-p1, 102.0.4, 102.0.2-p2, 102.0.3, 102.0.2, 102.0.1, 102.0.0].
    - Installation request for graycore/magento2-cors ^1.3 -> satisfiable by graycore/magento2-cors[1.3.0].

Can you support 'cors_allowed_origins' => 'https://.abc.com,',
"", that is, can any domain name under the domain be accessed?

💡 Feature request

Feature Name

Origin: Vary

The Desired Behavior

https://fetch.spec.whatwg.org/#cors-protocol-and-http-caches

Your Use Case

See: https://fetch.spec.whatwg.org/#cors-protocol-and-http-caches

🐢 Performance Issue

Current behavior

Currently, when we run a request, we incur a significant overhead of sessions, redis cache calls, and even some DB requests.

Expected behavior

We only incur a single cache call as well as the code to compute the headers.

📄 Documentation Request

What were you doing?

In #78 we were trying to use the extension in Commerce Cloud and it wasn't well documented how to do so.

Expected behavior

Easier to understand how to use this in Commerce cloud.

Existing Documentation

#78

Currently, we only support a subset of the CORS protocol. We should extend support to Access-Control-Expose-Headers

https://fetch.spec.whatwg.org/#http-access-control-expose-headers

We have tried to installed your module into Magento Cloud, We followed all initial steps which you given. we were trying to add system variable which you mentioned here - https://github.com/graycoreio/magento2-cors/blob/master/docs/stories/configuring-the-headers.md, but in Magento cloud env.php file is not editable, also there isn't any provision to add system variable into anywhere.

Do you have any other solution for adding all values under system? adding somewhere in config or .php file?

Environment

magento2-cors version: 1.6.0
Magento version: Magento Commerce 2.4.5
PHP Version version: 8.1

Currently, we assume that we are adding the CORS headers to all responses that match qualified requests in a given "area" like "webapi" or "graphql".

We should allow for per-resource security tightenting of CORS addition so that we can more precisely add headers to the correct requests.

🐛 Bug report

Current Behavior

Currently, it appears as if the preflight request is being interpreted as a "GET".

Expected Behavior

I want cached options requests.

Minimal reproduction of the problem with instructions

Make an options request with varnish.

What is the motivation / use case for changing the behavior?

Performance improvements at scale.

Environment

magento2-cors version: 1.4.0
Magento version: 2.4.1
PHP Version version: any 

Currently, we support only a subset of the CORS headers, we should extend support to Access-Control-Allow-Credentials

We should add CI to ensure consistent build quality. Preferably, we should use Azure DevOps.

Currently, while tests are written, they are not run in CI.

We need to run both the integration and unit tests, and these two processes can be done in parallel.

See https://github.com/magento/adobe-stock-integration/blob/1.1-develop/.travis.yml as an example of a working Travis sample. We would need to translate this over to Azure Devops and run against PR builds and master.

• Linting (static) (#16 and #17)
• Unit (#18 & #19)
• Integration
• Api-Functional

1. We should reference the packagist package in the readme.
2. We should also showcase the numbers of downloads of the package on packagist.