Prep for #2840

API.md

@@ -2123,8 +2123,8 @@ following options:
 - `cors` - the [Cross-Origin Resource Sharing](http://www.w3.org/TR/cors/) protocol allows
   browsers to make cross-origin API calls. CORS is required by web applications running
   inside a browser which are loaded from a different domain than the API server. CORS
-  headers are disabled by default. To enable, set `cors` to `true`, or to an object with
-  the following options:
+  headers are disabled by default (`false`). To enable, set `cors` to `true`, or to an object
+  with the following options:
     - `origin` - a strings array of allowed origin servers ('Access-Control-Allow-Origin').
       The array can contain any combination of fully qualified origins along with origin
       strings containing a wildcard '*' character, or a single `'*'` origin string. Defaults

lib/connection.js

@@ -78,8 +78,8 @@ exports = module.exports = internals.Connection = function (server, options) {
     this.states = new Statehood.Definitions(this.settings.state);
     this.auth = new Auth(this);
     this._router = new Call.Router(this.settings.router);
-    this._defaultRoutes();
     this._corsPaths = {};
+    this._defaultRoutes();
 
     this.plugins = {};                  // Registered plugin APIs by plugin name
     this.app = {};                      // Place for application-specific state without conflicts with hapi, should not be used by plugins
@@ -219,7 +219,7 @@ internals.Connection.prototype._stop = function (options, callback) {
 
 internals.Connection.prototype._cors = function (method, path, plugin, options) {
 
-    if (method === 'options' ||
+    if (['options', 'notfound', 'badrequest'].indexOf(method) !== -1 ||
         Hoek.deepEqual(this.settings.routes.cors, options)) {
 
         return;
@@ -230,6 +230,10 @@ internals.Connection.prototype._cors = function (method, path, plugin, options)
         return;
     }
 
+    if (!options) {
+        return;
+    }
+
     this._corsPaths[path] = Hoek.clone(options);
 
     this._route({

lib/route.js

@@ -153,12 +153,11 @@ exports = module.exports = internals.Route = function (options, connection, plug
 
     // CORS
 
-    if (this.settings.cors) {
-        this.settings.cors = Hoek.applyToDefaults(Defaults.cors, this.settings.cors);
-
-        var cors = this.settings.cors;
-        this.connection._cors(this.method, this.path, this.plugin, cors);
+    this.settings.cors = Hoek.applyToDefaults(Defaults.cors, this.settings.cors);
+    var cors = this.settings.cors;
+    this.connection._cors(this.method, this.path, this.plugin, cors);
 
+    if (cors) {
         cors._headers = cors.headers.concat(cors.additionalHeaders).join(',');
         cors._methods = cors.methods.concat(cors.additionalMethods).join(',');
         cors._exposedHeaders = cors.exposedHeaders.concat(cors.additionalExposedHeaders).join(',');

lib/schema.js

@@ -89,7 +89,7 @@ internals.routeBase = Joi.object({
         credentials: Joi.boolean(),
         override: Joi.boolean().allow('merge')
     })
-        .allow(null, false, true),
+        .allow(false, true),
     ext: Joi.object({
         onPreAuth: Joi.array().items(internals.event).single(),
         onPostAuth: Joi.array().items(internals.event).single(),

lib/server.js

@@ -111,7 +111,7 @@ internals.Server.prototype.connection = function (options) {
     var root = this.root;                                   // Explicitly use the root reference (for plugin invocation)
 
     var settings = Hoek.applyToDefaultsWithShallow(root._settings.connections, options || {}, ['listener', 'routes.bind']);
-    settings.routes.cors = Hoek.applyToDefaults(root._settings.connections.routes.cors || Defaults.cors, settings.routes.cors);
+    settings.routes.cors = Hoek.applyToDefaults(root._settings.connections.routes.cors || Defaults.cors, settings.routes.cors) || false;
     settings.routes.security = Hoek.applyToDefaults(root._settings.connections.routes.security || Defaults.security, settings.routes.security);
 
     settings = Schema.apply('connection', settings);       // Applies validation changes (type cast)