Access-Control-Allow-Origin not returned

[guocheng]

When I set CORS_ORIGIN_ALLOW_ALL = True, I can see Access-Control-Allow-Origin: * in the response header. However, when I set it to false, and use white list, I cannot see Access-Control-Allow-Origin in the response header.

CORS_ORIGIN_ALLOW_ALL = False

CORS_ORIGIN_WHITELIST = (
    '127.0.0.1',
)

I did supply Origin in the header.

[gustavi]

Thanks for the report. We check it soon.

[Crocmagnon]

Hello, Any news on this ?

[gustavi]

No time atm. In my TODO list but a PR is welcom !

[edmorley]

@guocheng, what are you passing as Origin in the request header?

From code inspection this should work if you pass Origin: http://127.0.0.1, however if instead Origin: 127.0.0.1, an Access-Control-Allow-Origin header wouldn't be set.