Aspnetcore: CORS AllowAnyHeader issue with Firefox

[rbanks54]

Describe the bug

The AllowAnyHeader() behaviour for seems to have changed between 2.0 and 2.2-preview3 and this causes problems with Firefox.
Previously preflight requests would return an Access-Control-Allow-Header containing the headers in the client request. This seems to have changed so that the server now returns a wildcard ('*') response.
Unfortunately the wildcard response appears to causes issue with Firefox. Chrome and Edge work correctly, however.

To Reproduce

Originally reported at: https://github.com/IdentityServer/IdentityServer4/issues/2731.
You'll find more details there, including some repro steps.

Expected behavior

Return to previous behaviour, rather returning the wildcard response

[blowdart]

Probably related to https://github.com/aspnet/AspNetCore/issues/3106 ?

[pranavkm]

Thanks for the bug report! Seems like an issue with Firefox. We changed the code to reflect the Access-Control-Request-Headers and Access-Control-Request-Method when the policy supports wildcard. We were already doing this when the policy was configured to support credentials. We'll continue to respond with * in the Access-Control-Allow-Origin header if the policy is configured to support all origins and supports credentials. This is a mitigation for #3106.

[rbanks54]

Confirmed this works now using the latest nightly build (2.2.100-rtm-009571)