{"action":"opened","issue":{"url":"https://api.github.com/repos/couchbase/sync_gateway/issues/1310","labels_url":"https://api.github.com/repos/couchbase/sync_gateway/issues/1310/labels{/name}","comments_url":"https://api.github.com/repos/couchbase/sync_gateway/issues/1310/comments","events_url":"https://api.github.com/repos/couchbase/sync_gateway/issues/1310/events","html_url":"https://github.com/couchbase/sync_gateway/issues/1310","id":118433778,"number":1310,"title":"(CORS) Cannot delete _session","user":{"login":"ricsmania","id":6311027,"avatar_url":"https://avatars.githubusercontent.com/u/6311027?v=3","gravatar_id":"","url":"https://api.github.com/users/ricsmania","html_url":"https://github.com/ricsmania","followers_url":"https://api.github.com/users/ricsmania/followers","following_url":"https://api.github.com/users/ricsmania/following{/other_user}","gists_url":"https://api.github.com/users/ricsmania/gists{/gist_id}","starred_url":"https://api.github.com/users/ricsmania/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ricsmania/subscriptions","organizations_url":"https://api.github.com/users/ricsmania/orgs","repos_url":"https://api.github.com/users/ricsmania/repos","events_url":"https://api.github.com/users/ricsmania/events{/privacy}","received_events_url":"https://api.github.com/users/ricsmania/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-11-23T17:44:16Z","updated_at":"2015-11-23T17:44:16Z","closed_at":null,"body":"I'm using Angular to sync with Sync Gateway using cookie-based auth. The web server and Sync Gateway are running on different domains, so I configured CORS on the sync.json to accept requests from the web server.\r\n\r\nI can sucessfully login by sending a POST to db/session, but I cannot logoff by sending a DELETE. \r\n\r\nEnvironment:\r\nMachine 1:\r\nWindows 10 Pro 64-bit\r\nIonic CLI 1.7.7\r\nChrome 46.0.2490.86 m (64-bit)\r\n\r\nMachine 2:\r\nUbuntu 15.04 64-bit\r\nCouchbase Sync Gateway/1.1.1(10;2fff9eb)\r\n\r\n\r\nMy login request:\r\n```js\r\n$http.post(`${$rootScope.syncDb}/_session`, {name: $scope.data.username, password: $scope.data.password}).then((result) => {\r\n                  $scope.loggedInUser = result.data.userCtx.name\r\n                  myPopup.close()\r\n                }\r\n```\r\n\r\nMy logoff request:\r\n```js\r\n$scope.logoff = () => {\r\n      $http.delete(`${$rootScope.syncDb}/_session`).then((result) => {\r\n        $scope.loggedInUser = \"\"\r\n      })\r\n    }\r\n```\r\n\r\nAnd the response:\r\n```json\r\n{\"error\":\"Bad Request\",\"reason\":\"No CORS\"}\r\n```\r\n\r\nReading the source I saw that the domain is checked on the POST method but not on DELETE. On the DELETE method, the handler only checks if the \"Origin\" header exists and return an error if it does. Shouldn't CORS be treated the same way on both methods? Or am I doing something wrong on my request?\r\n\r\n\r\n\r\nI also configured Angular to always send credentials:\r\n```js\r\n.config(['$httpProvider',\r\nfunction($httpProvider) {\r\n  $httpProvider.defaults.withCredentials = true;\r\n}\r\n```\r\n\r\nPOST handler:\r\n```go\r\n// CORS not allowed for login #115 #762\r\noriginHeader := h.rq.Header[\"Origin\"]\r\n\tif len(originHeader) > 0 {\r\n\t\tmatched := \"\"\r\n\t\tif h.server.config.CORS != nil {\r\n\t\t\tmatched = matchedOrigin(h.server.config.CORS.LoginOrigin, originHeader)\r\n\t\t}\r\n\t\tif matched == \"\" {\r\n\t\t\treturn base.HTTPErrorf(http.StatusBadRequest, \"No CORS\")\r\n\t\t}\r\n\t}\r\n```\r\n\r\nDELETE handler:\r\n```go\r\nif len(h.rq.Header[\"Origin\"]) > 0 {\r\n\t\t// CORS not allowed for login #115\r\n\t\treturn base.HTTPErrorf(http.StatusBadRequest, \"No CORS\")\r\n\t}\r\n```"}}