Track CORS middleware reflected Origin behavior for credentialed requests

[coderabbitai]

Summary

Track the CORS middleware change introduced in #1385 for credentialed cross-origin requests when OriginURL is configured as "*".

The pull request updates the middleware so that:

• when OriginURL == "*", the server reflects the incoming request's Origin header in Access-Control-Allow-Origin
• when OriginURL is set to a specific value, the configured value continues to be returned unchanged
• Access-Control-Allow-Credentials: true remains enabled

Rationale

Browsers reject responses that combine:

• Access-Control-Allow-Origin: *
• Access-Control-Allow-Credentials: true

Without reflecting the request Origin in the wildcard configuration case, credentialed CORS requests can fail despite the server intending to allow them.

Affected areas

• pkg/server/http_server.go
• corsMiddleware
• CORS handling for both preflight OPTIONS requests and non-preflight requests

Acceptance criteria

• The middleware reflects the incoming Origin header when OriginURL == "*"
• The middleware preserves the configured static origin when OriginURL != "*"
• Responses remain compatible with browser credentialed CORS enforcement
• The issue remains linked to the implementation PR for traceability

Backlinks

• Pull request: CORS Reflect Origin #1385
• Requesting comment: CORS Reflect Origin #1385 (comment)

Requested by @dogancanbakir.

[jub0bs]

@dogancanbakir The changes suggested here are generally harmful (see https://portswigger.net/research/exploiting-cors-misconfigurations-for-bitcoins-and-bounties). Moreover, I don't believe that

Access-Control-Allow-Credentials: true

is necessary here; see https://stackoverflow.com/a/76202037.

---

Incidentally, I think interactsh would benefit from relying on jub0bs/cors. interactsh's current CORS implementation isn't quite correct (CORS-preflight response headers are being included in responses to actual requests). If #1412 gets merged, I'll follow up with a PR to do that.