Users currently cannot allow methods that are not uppercase

[jub0bs]

The Fetch standard states that methods are, in general, case-sensitive. For instance, PATCH is distinct from patch.

However, Gin's CORS middleware currently uppercases the allowed methods before writing the result in the Access-Control-Allow-Methods. Therefore, Gin's CORS middleware prevents its users from allowing methods that are not already uppercase.

Accordingly, two currently passing test cases, TestGeneratePreflightHeaders_AllowMethods and TestPassesAllowOrigins, should actually fail, because their assertions on w.Header().Get("Access-Control-Allow-Methods") are incorrect.

FWIW, this undue case-normalisation can be deplored in other CORS middleware libraries and it tends to trip users up. Gin should fixed this.

[jub0bs]

Related: rs/cors#158