title: Testing CORS with the Postman tool/ cURL/ in Chrome console
body: <p>I'm testing CORS with the Postman tool and I constantly get</p>
  
  <pre><code>access-control-allow-origin → null
  </code></pre>
  
  <p>for <code>GET</code> or <code>OPTIONS</code> requests to</p>
  
  <pre><code>http://localhost:4000/api/accounts?Host=http://localhost:4200/&amp;X-Origin=http://jquery.com
  </code></pre>
  
  <p>Also using <code>Origin</code> instead of <code>X-Origin</code> doesn't change the outcome.
  Meanwhile, if I use cURL like this</p>
  
  <pre><code> curl -H "Origin: http://jquery.com" --verbose http://localhost:4000/api/accounts
  </code></pre>
  
  <p>I do gain access to the API</p>
  
  <pre><code>&lt; access-control-allow-origin: http://jquery.com
  </code></pre>
  
  <p>I've also opened the jQuery website using <code>http</code> and the chrome Javascript console in order to execute this code:</p>
  
  <pre><code>$.get("http://localhost:4000/api/accounts").then(function(val){console.log(val);})
  </code></pre>
  
  <p>And it printed the JSON object returned by the API.</p>
  
  <p>Now my questions are as follows:</p>
  
  <ol>
  <li><p>How can I properly test CORS using Postman? I've noticed that when set the allow origins option on the server to <code>*</code> Postman does return </p>
  
  <p><code>access-control-allow-origin → *</code></p></li>
  </ol>
  
  <p>The problem mentioned above appears only when I explicitly allow a set of origins like:</p>
  
  <pre><code>`origin: ["https://www.getpostman.com/", "http://localhost:4200/", "http://jquery.com"]`
  </code></pre>
  
  <ol start="2">
  <li>I noticed that allowing <code>http://jquery.com/</code> instead of <code>http://jquery.com</code> will not allow requests from which the origin is <code>Origin=http://jquery.com</code>?</li>
  <li>I've noticed that cURL returns the contents of the resource (in this case JSON data) even if the request comes from non-authorized origin. Is this normal or does it mean that I forgot to configure something on the server that exposes this data?</li>
  </ol>