Testing CORS with the Postman tool/ cURL/ in Chrome console
<p>I'm testing CORS with the Postman tool and I constantly get</p>

<pre><code>access-control-allow-origin → null
</code></pre>

<p>for <code>GET</code> or <code>OPTIONS</code> requests to</p>

<pre><code>http://localhost:4000/api/accounts?Host=http://localhost:4200/&amp;X-Origin=http://jquery.com
</code></pre>

<p>Also using <code>Origin</code> instead of <code>X-Origin</code> doesn't change the outcome.
Meanwhile, if I use cURL like this</p>

<pre><code> curl -H "Origin: http://jquery.com" --verbose http://localhost:4000/api/accounts
</code></pre>

<p>I do gain access to the API</p>

<pre><code>&lt; access-control-allow-origin: http://jquery.com
</code></pre>

<p>I've also opened the jQuery website using <code>http</code> and the chrome Javascript console in order to execute this code:</p>

<pre><code>$.get("http://localhost:4000/api/accounts").then(function(val){console.log(val);})
</code></pre>

<p>And it printed the JSON object returned by the API.</p>

<p>Now my questions are as follows:</p>

<ol>
<li><p>How can I properly test CORS using Postman? I've noticed that when set the allow origins option on the server to <code>*</code> Postman does return </p>

<p><code>access-control-allow-origin → *</code></p></li>
</ol>

<p>The problem mentioned above appears only when I explicitly allow a set of origins like:</p>

<pre><code>`origin: ["https://www.getpostman.com/", "http://localhost:4200/", "http://jquery.com"]`
</code></pre>

<ol start="2">
<li>I noticed that allowing <code>http://jquery.com/</code> instead of <code>http://jquery.com</code> will not allow requests from which the origin is <code>Origin=http://jquery.com</code>?</li>
<li>I've noticed that cURL returns the contents of the resource (in this case JSON data) even if the request comes from non-authorized origin. Is this normal or does it mean that I forgot to configure something on the server that exposes this data?</li>
</ol>