config.enableCorsForAllOrigins() is not adding proper CORS headers

Actual behavior (the bug) Http header “access-control-allow-origin:*” is not being added to responses

Expected behavior header should be present on all responses

To Reproduce

Javalin.create().apply {
            config.contextPath = "/"
            config.enableCorsForAllOrigins()
            config.enableDevLogging()
            get("/") { ctx -> ctx.html("test") }
        }.start(80)

Workaround I needed to use in order to get the CORS header in all requests is this:

Javalin.create().apply {
            config.contextPath = "/"
            config.enableCorsForAllOrigins()
            config.enableDevLogging()
            before { ctx ->
                ctx.header(Header.ACCESS_CONTROL_ALLOW_ORIGIN, "*")
            }
            get("/") { ctx -> ctx.html("test") }
        }.start(80)

[Nikita-Chernenko]

alright, the correct way to apply it was

    val app = Javalin.create { config ->
        config.contextPath = "/"
        config.enableDevLogging()
        config.enableCorsForAllOrigins()
    }.start(port)

now it works

[sfPlayer1]

FYI the way this sneakily substitutes * with the Origin header value breaks external caches that weren’t configured for this behavior. A cached response from one origin may be sent to another requests with a different origin.