envoyproxy/gateway

CORS: implicitly allows OPTIONS method when SecurityPolicy with CORS attached to a path to serve preflight requests

Open

#7,372 opened on Oct 30, 2025

View on GitHub
 (6 comments) (0 reactions) (1 assignee)Go (802 forks)auto 404
help wantedkind/enhancement

Repository metrics

Stars
 (2,871 stars)
PR merge metrics
 (PR metrics pending)

Description

#7144 implicitly allows OPTIONS method when CORS filter attached to a path to serve preflight requests. We should consider doing the same for SecurityPolicy with CORS to keep the behavior consistent.

Related to #6316

Contributor guide

Research direction
Tech stack
Domain
Issue type
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Prerequisites
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.