Fix safelisted CORS headers implementation

diff --git a/starlette/middleware/cors.py b/starlette/middleware/cors.py
index 692494216f944c33710a5327be694d6b5062d969..338aee863a16a91bea403dc641afa9a3aaef8dc7 100644 (file)
--- a/starlette/middleware/cors.py
+++ b/starlette/middleware/cors.py
@@ -7,7 +7,7 @@ from starlette.responses import PlainTextResponse, Response
 from starlette.types import ASGIApp, Message, Receive, Scope, Send
 
 ALL_METHODS = ("DELETE", "GET", "OPTIONS", "PATCH", "POST", "PUT")
-SAFELISTED_HEADERS = {"accept", "accept-language", "content-language", "content-type"}
+SAFELISTED_HEADERS = {"Accept", "Accept-Language", "Content-Language", "Content-Type"}
 
 
 class CORSMiddleware:
@@ -49,7 +49,7 @@ class CORSMiddleware:
                 "Access-Control-Max-Age": str(max_age),
             }
         )
-        allow_headers = SAFELISTED_HEADERS | set([h.lower for h in allow_headers])
+        allow_headers = sorted(SAFELISTED_HEADERS | set(allow_headers))
         if allow_headers and "*" not in allow_headers:
             preflight_headers["Access-Control-Allow-Headers"] = ", ".join(allow_headers)
         if allow_credentials:
@@ -58,7 +58,7 @@ class CORSMiddleware:
         self.app = app
         self.allow_origins = allow_origins
         self.allow_methods = allow_methods
-        self.allow_headers = allow_headers
+        self.allow_headers = [h.lower() for h in allow_headers]
         self.allow_all_origins = "*" in allow_origins
         self.allow_all_headers = "*" in allow_headers
         self.allow_origin_regex = compiled_allow_origin_regex

diff --git a/tests/middleware/test_cors.py b/tests/middleware/test_cors.py
index e8bf72fdda42c583068a8b2435e0e465a404b884..a5b6e62358182adeb92c365083e0e52cd304bf90 100644 (file)
--- a/tests/middleware/test_cors.py
+++ b/tests/middleware/test_cors.py
@@ -74,7 +74,9 @@ def test_cors_allow_specific_origin():
     assert response.status_code == 200
     assert response.text == "OK"
     assert response.headers["access-control-allow-origin"] == "https://example.org"
-    assert response.headers["access-control-allow-headers"] == "X-Example, Content-Type"
+    assert response.headers["access-control-allow-headers"] == (
+        "Accept, Accept-Language, Content-Language, Content-Type, X-Example"
+    )
 
     # Test standard response
     headers = {"Origin": "https://example.org"}
@@ -157,7 +159,9 @@ def test_cors_allow_origin_regex():
     assert response.status_code == 200
     assert response.text == "OK"
     assert response.headers["access-control-allow-origin"] == "https://another.com"
-    assert response.headers["access-control-allow-headers"] == "X-Example, Content-Type"
+    assert response.headers["access-control-allow-headers"] == (
+        "Accept, Accept-Language, Content-Language, Content-Type, X-Example"
+    )
 
     # Test disallowed pre-flight response
     headers = {