i'm trying to add cors headers through the pedestal config. i set ::http/allowed-origins ["*"] but the header i get back is blank: Access-Control-Allow-Origin: and there is no Access-Control-Allow-Methods: header. even if i force "*" for that header, it still gets stripped out. is this something i need a custom interceptor for?

your usage sounds correct to me - I would just double check what the final service config looks like when you start the server. Maybe try copying your service config to a new app template and see if that works also

minus the routes, it looks like this:

{:env :prod,
 :io.pedestal.http/not-found-interceptor {:name :neo.common.http.passthrough/passthrough,
                                          :leave #object[neo.common.http.passthrough$fn__36795
                                                         0x6ba197f9
                                                         "neo.common.http.passthrough$fn__36795@6ba197f9"]},
 :io.pedestal.http/routes #{...},
 :io.pedestal.http/allowed-origins ["*"],
 :io.pedestal.http/type :jetty,
 :io.pedestal.http/container-options {:h2c? true, :h2? false, :ssl? false},
 :io.pedestal.http/host "0.0.0.0",
 :io.pedestal.http/port 8080}

in the template, i get no cors headers at all w/ that setting on or off

interesting I'm seeing the headers not show up as well with '*'. digging into the implementation it looks like the origin check is using set membership: https://github.com/pedestal/pedestal/blob/master/service/src/io/pedestal/http/cors.clj#L57

so the * won't work here

i c. good to know. i opened up a ticket for this https://github.com/pedestal/pedestal/issues/664

::http/allowed-origins {:creds true :allowed-origins (constantly true)}})

that should effectively be the same as "*"

that gives me an error unfortunately: #error{:cause "class java.lang.Long cannot be cast to class clojure.lang.IPersistentCollection (java.lang.Long is in module java.base of loader 'bootstrap'; clojure.lang.IPersistentCollection is in unnamed module of loader 'app')",

seems like that is caused by something else. Here's a full example: https://github.com/pedestal/pedestal/blob/master/samples/cors/src/cors/server.clj#L27

i'm getting the error running normally also, so it's not just the run-dev

unfortunately, removing that line from my run dev ends up w/ everything responding w/ a 403