Description:

When the CORS filter is engaged and the preflight request reaches the filter, that request should be handled via the CORS filter despite the request should be rejected or not.

While testing, I have had the following observations.

• When I am sending the preflight request, with one of the allowed origins as the origin header It works perfectly fine. Cors filter responds for the request as expected. No issues found.
• When the preflight request is sent with some other origin, instead of its being failed it is passed to the next filter (and eventually to the upstream). In my opinion, this also needs to be handled via the cors filter.

I think this is something better to be fixed. And your thoughts are highly appreciated.

Repro steps:

Provide a route with CORS configuration applied within envoy.yaml and perform a preflight request with some arbitrary Origin header (which is not the allowed one ) using curl.
ex.
curl -X OPTIONS "https://localhost:9095/v2/pet" -H "Origin:https://test.com" -H "Access-Control-Request-Method:POST" -k -v

Config:
This is a sample CORS configuration I used for the route.

"cors": {
            "allow_methods": "GET, PUT",
            "allow_headers": "Authorization, Content-Type",
            "allow_credentials": true,
            "allow_origin_string_match": [
             {
              "safe_regex": {
               "google_re2": {},
               "regex": "https://test\\.com"
              }
             }
            ]
           }
          },