[BUG] Unable to set CORS headers

Describe the bug

Attempting to add CORS headers does not work.

To Reproduce There are two ways to add the CORS headers- using the Starlette CORS middleware, or by manually adding headers. Neither work.

from fastapi import FastAPI
from starlette.middleware.cors import CORSMiddleware

app = FastAPI()
app.add_middleware(CORSMiddleware, allow_origins=['*'])

@app.get('/ping', content_type=UJSONResponse)
def health_check():
    return UJSONResponse({'status': 'ok'}, headers={'Access-Control-Allow-Origin': '*'})

It looks like the middleware is just completely ignored, and the headers defined in the routes don’t work when the “OPTIONS” verb is used.

Expected behavior The CORS headers should be set.

Environment:

Tested with tiangolo/uvicorn-gunicorn-fastapi:python3.6.

[ccharlesgb]

@CoderCharm, we ran into this issue a while back it is due to CORS policies: https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS/Errors/CORSNotSupportingCredentials

If the request sends credentials then you are not allowed any origin (i.e allow_origins=['*']) and the origin must be ‘reflected’ back by the Middleware dynamically (Which is what the regex does):

https://github.com/encode/starlette/blob/93878323e57e0bab92b4622849c67f5a7c96b24e/starlette/middleware/cors.py#L107

[tiangolo]

Aha! Hehe great.