Help Debugging Upstream CORS Error

Questions
1

Hello, I could use some help debugging why an upstream server is failing CORS. I don’t know if this is a Kong specific thing or if I’m just not understanding CORS correctly but here is my situation.

I have some external APIs I need to access, and I’m putting Kong in between my browser client and the APIs.

Browser -> Kong -> External API

My issue is that the external API has a CORS setting that blocks localhost so when developing locally, all requests from the browser to Kong are failing CORS because Kong forwards the Origin and Host headers as localhost. What I thought you can do is use the Request Transformer plugin to change those headers so it will pass CORS but it does not seem to be working. Here is my configuration:

Service:

{
  "next": null,
  "data": [
    {
      "host": "development-pgna-pfsweb.demandware.net",
      "created_at": 1544813374,
      "connect_timeout": 60000,
      "id": "dc69ddbe-e1e1-449b-9b4c-547e5903ecc1",
      "protocol": "https",
      "name": "ocapi",
      "read_timeout": 60000,
      "port": 443,
      "path": null,
      "updated_at": 1544813374,
      "retries": 5,
      "write_timeout": 60000
    }
  ]
}

Plugin:

{
  "total": 1,
  "data": [
    {
      "created_at": 1544813381000,
      "config": {
        "remove": {
          "querystring": {},
          "headers": [
            "Origin",
            "Host"
          ],
          "body": {}
        },
        "add": {
          "querystring": {},
          "headers": [
            "Origin:https://development-pgna-pfsweb.demandware.net",
            "Host:development-pgna-pfsweb.demandware.net"
          ],
          "body": {}
        },
        "append": {
          "querystring": {},
          "headers": {},
          "body": {}
        },
        "replace": {
          "querystring": {},
          "headers": {},
          "body": {}
        },
        "rename": {
          "querystring": {},
          "headers": {},
          "body": {}
        }
      },
      "id": "64eb39fd-7414-4623-bf6d-b1860901dcfb",
      "name": "request-transformer",
      "service_id": "dc69ddbe-e1e1-449b-9b4c-547e5903ecc1",
      "enabled": true
    }
  ]
}

Route:

{
  "next": null,
  "data": [
    {
      "created_at": 1544813391,
      "strip_path": true,
      "hosts": null,
      "preserve_host": false,
      "regex_priority": 0,
      "updated_at": 1544813391,
      "paths": null,
      "service": {
        "id": "dc69ddbe-e1e1-449b-9b4c-547e5903ecc1"
      },
      "methods": [
        "GET",
        "POST",
        "PUT",
        "DELETE",
        "OPTIONS",
        "HEAD"
      ],
      "protocols": [
        "http",
        "https"
      ],
      "id": "0e05ae5a-b4c2-4672-81df-de705f2c215f"
    }
  ]
}

I’d love to know if this is expected behavior and if I’m doing something wrong. Replicating this request with curl seems to work fine in the terminal, but the browser always errors when going through Kong and it says it is still trying to pass CORS with the localhost Origin, which doesn’t seem to be getting overridden in the plugin.

EDIT: Running Kong 0.14.1

2

After some more experimentation, it looks like Kong is not setting the upstream Host header. Is this expected behavior?