CORS

Fixed an issue where requests with empty origin headers would cause empty reply from server.

Added an option to skip returning the Access-Control-Allow-Origin response header when requests don’t have the Origin header.

Fixed an issue where the Access-Control-Allow-Origin header was not sent when conf.origins has multiple entries but includes *.

Support the Access-Control-Request-Private-Network header in crossing-origin pre-light requests

Support the Access-Control-Request-Private-Network header in crossing-origin pre-light requests

Improved Plugin Documentation: Revised docs for the following plugins to include examples:

• CORS
• File Log
• HTTP Log
• JWT Signer
• Key Auth
• OpenID Connect
• Rate Limiting Advanced
• SAML
• StatsD

Improved Plugin Documentation: CORS

The CORS plugin does not send the Vary: Origin header anymore when the header Access-Control-Allow-Origin is set to *.

Thanks, @jkla-dr! #8401