document last additions from Lai Quang Duong

rbri · rbri · commit 52f9ba429cd4 · 2026-03-12T13:23:09.000+01:00
diff --git a/src/changes/changes.xml b/src/changes/changes.xml
@@ -8,6 +8,9 @@
 
     <body>
         <release version="5.0.0" date="April 01, 2026" description="jdk17, Bugfixes">
+            <action type="fix" dev="Lai Quang Duong">
+                Correcting CORS preflight handling by properly recognize the wildcard '*' value for the Access-Control-Allow-Headers response header.
+            </action>
             <action type="add" dev="Lai Quang Duong">
                 Intl: supportedLocalesOf() implementation added to DateTimeFormat and NumberFormat.
             </action>
diff --git a/src/main/java/org/htmlunit/javascript/host/xml/XMLHttpRequest.java b/src/main/java/org/htmlunit/javascript/host/xml/XMLHttpRequest.java
@@ -1133,7 +1133,7 @@ private boolean isPreflightAuthorized(final WebResponse preflightResponse) {
             if (HttpHeader.ACCESS_CONTROL_ALLOW_HEADERS.equalsIgnoreCase(pair.getName())) {
                 String value = pair.getValue();
                 if (value != null) {
-                    if ("*".equals(value)) {
+                    if (ALLOW_ORIGIN_ALL.equals(value)) {
                         // all headers are allowed
                         return true;
                     }
diff --git a/src/test/java/org/htmlunit/javascript/host/xml/XMLHttpRequestCORSTest.java b/src/test/java/org/htmlunit/javascript/host/xml/XMLHttpRequestCORSTest.java
@@ -45,6 +45,7 @@
  * @author Marc Guillemot
  * @author Ronald Brill
  * @author Frank Danek
+ * @author Lai Quang Duong
  */
 public class XMLHttpRequestCORSTest extends WebDriverTestCase {
 

Original file line number	Diff line number	Diff line change
`@@ -1133,7 +1133,7 @@ private boolean isPreflightAuthorized(final WebResponse preflightResponse) {`
`1133`	`1133`	`if (HttpHeader.ACCESS_CONTROL_ALLOW_HEADERS.equalsIgnoreCase(pair.getName())) {`
`1134`	`1134`	`String value = pair.getValue();`
`1135`	`1135`	`if (value != null) {`
`1136`		`- if ("*".equals(value)) {`
	`1136`	`+ if (ALLOW_ORIGIN_ALL.equals(value)) {`
`1137`	`1137`	`// all headers are allowed`
`1138`	`1138`	`return true;`
`1139`	`1139`	`}`