Next line returns 200 as status https://github.com/Kong/kong/blob/c817fada7a514d84f6e0aab7461605c71bf3a841/kong/plugins/cors/handler.lua#L13

Internet says it should return 204:

• https://developer.mozilla.org/en-US/docs/Glossary/Preflight_request
• https://docs.microsoft.com/en-us/aspnet/core/security/cors?view=aspnetcore-3.1#preflight-requests

Internet changed its mind since 2018 https://

**Do you want to request a feature or report a bug?

Feature?

What is the current behavior?
Session object ACLs require both the key and the api_id field of the ACL definition to match.

If they mismatch the API does not throw an error.

What is the expected behavior?

The Gateway API should report the discrepancy to stop the token from being generated.

Issue description

no doc to follow

Environment

apisix 2.0

• apisix version (cmd: apisix version):
• OS:centos 7

virtual host options

It may be helpful to not only allow wildcards for HTTP status rules like *, but also 4* .

Would there be any appetite to add a rule that checks for the inclusion of required and optional fields in your API?

• E2E Test
• Build & Deploy