http: CORS should not be send if not set (#6433)

lib/http/middleware_test.go

@@ -332,13 +332,6 @@ func TestMiddlewareCORS(t *testing.T) {
 		name string
 		http Config
 	}{
-		{
-			name: "EmptyOrigin",
-			http: Config{
-				ListenAddr:  []string{"127.0.0.1:0"},
-				AllowOrigin: "",
-			},
-		},
 		{
 			name: "CustomOrigin",
 			http: Config{
@@ -389,6 +382,55 @@ func TestMiddlewareCORS(t *testing.T) {
 	}
 }
 
+func TestMiddlewareCORSEmptyOrigin(t *testing.T) {
+	servers := []struct {
+		name string
+		http Config
+	}{
+		{
+			name: "EmptyOrigin",
+			http: Config{
+				ListenAddr:  []string{"127.0.0.1:0"},
+				AllowOrigin: "",
+			},
+		},
+	}
+
+	for _, ss := range servers {
+		t.Run(ss.name, func(t *testing.T) {
+			s, err := NewServer(context.Background(), WithConfig(ss.http))
+			require.NoError(t, err)
+			defer func() {
+				require.NoError(t, s.Shutdown())
+			}()
+
+			expected := []byte("data")
+			s.Router().Mount("/", testEchoHandler(expected))
+			s.Serve()
+
+			url := testGetServerURL(t, s)
+
+			client := &http.Client{}
+			req, err := http.NewRequest("GET", url, nil)
+			require.NoError(t, err)
+
+			resp, err := client.Do(req)
+			require.NoError(t, err)
+			defer func() {
+				_ = resp.Body.Close()
+			}()
+
+			require.Equal(t, http.StatusOK, resp.StatusCode, "should return ok")
+
+			testExpectRespBody(t, resp, expected)
+
+			for _, key := range _testCORSHeaderKeys {
+				require.NotContains(t, resp.Header, key, "CORS headers should not be sent")
+			}
+		})
+	}
+}
+
 func TestMiddlewareCORSWithAuth(t *testing.T) {
 	authServers := []struct {
 		name string