If there is an Access-Control-Request-Method header in the request and Access-Control-Request-Method is allowed for cross ori

HTTP headers are case insensitive. We should respect that and match regardless of case, returning the casing sent by

If every element in the Access-Control-Request-Headers is not an allowed header, then the matching headers should be returned

Ensure we do not error if the user specifies an bad regular expression.

If the Access-Control-Allow-Origin header will change dynamically, the Vary:Origin header should be set.

If Flask-Cors adds a Vary header and there is already a Vary header set, the headers should be combined and comma-separated.

By default, allow all domains, which means the Vary:Origin header should be set.

By default match all.

Access-Control-Allow-Methods headers should only be returned if the client makes an OPTIONS request.

The default behavior should automatically provide OPTIONS and return CORS headers.

By default, no max-age headers should be returned

If there is no Origin header in the request, the Access-Control-Allow-Origin header should be '*' by default.

If there is no Origin header in the request, by default the '*' should be sent

If there is an Origin header in the request, the Access-Control-Allow-Origin header should be included.

If there is an Origin header in the request, the Access-Control-Allow-Origin header should be included.

If regex does not match, do not set CORS

If there is an Origin header in the request, the Access-Control-Allow-Origin header should be echoed.

If there is an Origin header in the request, the Access-Control-Allow-Origin header should be echoed.

If the methods parameter is defined, it should override the default methods defined by the user.

HTTP Responses generated by calling abort are handled identically to normal responses, and should be wrapped by CORS headers

HTTP Responses generated by calling abort are handled identically to normal responses, and should be wrapped by CORS headers

Uncaught exceptions will trigger Flask's internal exception handler, and should have ACL headers only if intercept_exceptions

Ensure we work even if response.headers is set to something other than a MultiDict.

Tests the corner case occurs when the send_always setting is True and no Origin header in the request, it is not possible to

If there is an Origin header in the request, the Access-Control-Allow-Origin header should be included.

If there is an Origin header in the request, the Access-Control-Allow-Origin header should be echoed back.

If there is an Origin header in the request, the Access-Control-Allow-Origin header should be echoed back.

If there is an Origin header in the request, the Access-Control-Allow-Origin header should be echoed back.

If there is an Origin header in the request, the Access-Control-Allow-Origin header should be echoed back.

Ensure we do not error if the user specifies an bad regular expression.

Resources that wish to enable themselves to be shared with multiple Origins but do not respond uniformly with "*" must in pra

If there is an Origin header in the request, the Access-Control-Allow-Origin header should be echoed back.

If there is no Origin header in the request, the Access-Control-Allow-Origin header should not be included.

If there is an Origin header in the request, the Access-Control-Allow-Origin header should be echoed back.