CORS middleware doesnt automatically handle OPTIONS routes for groups anymore since upgrade to v5

[philicious]

Not sure if this intended behavior or a regression:

I have had code working with echo v4 like

r := e.Group("/myroute", middleware.CORSWithConfig(middleware.CORSConfig{
	AllowOrigins: []string{
		"http://localhost:3000", // local frontend
		"https://mydomain.de",
	},
	AllowHeaders: []string{echo.HeaderOrigin, echo.HeaderContentType, echo.HeaderAccept, echo.HeaderAuthorization},
}))

r.GET("", controller.GetStuff)
...

now after upgrading to v5 I suddenly experience CORS errors

Access to XMLHttpRequest at XX from origin 'https://mydomain.de' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.

and indeed the header is missing.

A fix was to explicitly add routes for OPTIONS on all groups with CORS middleware

func addPreflight(g *echo.Group) {
	h := func(c *echo.Context) error {
		return c.NoContent(http.StatusNoContent)
	}

	g.OPTIONS("", h)
	g.OPTIONS("/", h)
	g.OPTIONS("/*", h)
}

further investigation showed the CORS middleware HandlerFunc isnt invoked at all for OPTIONS-method if not explicitly added to routes in case CORS is added to a group.

known good version: v4.15.1

however I didnt see mentions of that in migration guide. did I miss them? is this new expected behavior?

[aldas]

This is not actually CORS middleware related. In v5 the group does not register implicit RouteNotFound routes on same path and if there are no routes the middleware will not be run.

This is what happened when you created group with middleware in v4 (g.Use is called also during group creation)

echo/group.go

Lines 22 to 33 in 6f3a84a

	func (g *Group) Use(middleware ...MiddlewareFunc) {
	g.middleware = append(g.middleware, middleware...)
	if len(g.middleware) == 0 {
	return
	}
	// group level middlewares are different from Echo `Pre` and `Use` middlewares (those are global). Group level middlewares
	// are only executed if they are added to the Router with route.
	// So we register catch all route (404 is a safe way to emulate route match) for this group and now during routing the
	// Router would find route to match our request path and therefore guarantee the middleware(s) will get executed.
	g.RouteNotFound("", NotFoundHandler)
	g.RouteNotFound("/*", NotFoundHandler)
	}

and this is v5

echo/group.go

Lines 22 to 24 in 0143b9d

	func (g *Group) Use(middleware ...MiddlewareFunc) {
	g.middleware = append(g.middleware, middleware...)
	}

I think at very least we need to update docs about this