HTTP Responses generated by calling abort are handled identically to normal responses, and should be wrapped by CORS headers

HTTP Responses generated by calling abort are handled identically to normal responses, and should be wrapped by CORS headers

If a 500 handler is setup by the user, responses should have CORS matching rules applied, regardless of whether or not

If a 500 handler is setup by the user, responses should have CORS matching rules applied, regardless of whether or not

Uncaught exceptions will trigger Flask's internal exception handler, and should have ACL headers only if intercept_exceptions

Uncaught exceptions will trigger Flask's internal exception handler, and should have ACL headers only if intercept_exceptions

No ACL_REQUEST_HEADERS sent, ACL_ALLOW_HEADERS should be empty

If there is an Access-Control-Request-Method header in the request and Access-Control-Request-Method is allowed for cross ori

HTTP headers are case insensitive. We should respect that and match regardless of case, returning the casing sent by

If every element in the Access-Control-Request-Headers is not an allowed header, then the matching headers should be returned

Blueprints should also be configurable via ``init_app``.

Routes that do not match the configured resource should not have CORS headers set.

Routes registered on a CORS-enabled blueprint and matching the configured resource should receive CORS headers.

Ensure we do not error if the user specifies an bad regular expression.

If the Access-Control-Allow-Origin header will change dynamically, the Vary:Origin header should be set.

If Flask-Cors adds a Vary header and there is already a Vary header set, the headers should be combined and comma-separated.

The specified route should return the Access-Control-Allow-Credentials header.

By default, allow all domains, which means the Vary:Origin header should be set.

By default match all.

Access-Control-Allow-Methods headers should only be returned if the client makes an OPTIONS request.

The default behavior should automatically provide OPTIONS and return CORS headers.

By default, no max-age headers should be returned

If there is no Origin header in the request, the Access-Control-Allow-Origin header should be '*' by default.

If there is no Origin header in the request, by default the '*' should be sent

If there is an Origin header in the request, the Access-Control-Allow-Origin header should be included.

If there is an Origin header in the request, the Access-Control-Allow-Origin header should be included.

If regex does not match, do not set CORS

If there is an Origin header in the request, the Access-Control-Allow-Origin header should be echoed.

If there is an Origin header in the request, the Access-Control-Allow-Origin header should be echoed.

If the methods parameter is defined, it should override the default methods defined by the user.

HTTP Responses generated by calling abort are handled identically to normal responses, and should be wrapped by CORS headers

HTTP Responses generated by calling abort are handled identically to normal responses, and should be wrapped by CORS headers

Uncaught exceptions will trigger Flask's internal exception handler, and should have ACL headers only if intercept_exceptions

Ensure we work even if response.headers is set to something other than a MultiDict.

Ensure that CORS matches + literally and allows the correct origin

Origin not allowed for + path should be rejected

Tests the corner case occurs when the send_always setting is True and no Origin header in the request, it is not possible to

If there is an Origin header in the request, the Access-Control-Allow-Origin header should be included.

If there is an Origin header in the request, the Access-Control-Allow-Origin header should be echoed back.

If there is an Origin header in the request, the Access-Control-Allow-Origin header should be echoed back.

Ensure that CORS treats /service path differently and allows correct origin

Origin not allowed for space path should be rejected

If there is an Origin header in the request, the Access-Control-Allow-Origin header should be echoed back.

If there is an Origin header in the request, the Access-Control-Allow-Origin header should be echoed back.