Fix CORS middleware to handle Authorization header

[veeceey]

Summary

• Fixes CORSMiddleware to check for Authorization headers in addition to cookies when determining whether to return specific origin vs wildcard
• Addresses issue CORSMiddleware does not provide explicit origin although Authorization header is present #1832

Background

When sending a CORS request with credentials (either cookies or Authorization header), the wildcard origin (*) is rejected by the browser according to the CORS specification. The middleware was correctly handling this for cookies, but not for Authorization headers.

Since token-based authentication (Bearer tokens) is widely used in modern APIs, the Authorization header should be treated the same as cookies when determining CORS behavior.

Changes

1. Code: Added check for authorization header alongside the existing cookie check in starlette/middleware/cors.py
2. Tests: Added comprehensive test coverage for Authorization header behavior:
   • Test that Authorization header triggers explicit origin in response (like cookies do)
   • Test that Vary header is properly set with Authorization header
   • Test credentialed requests return specific origin

Testing

All existing tests pass, and new tests verify the Authorization header behavior:

$ pytest tests/middleware/test_cors.py -xvs
17 passed in 0.09s

CORS Specification Compliance

According to the CORS spec, when credentials are present in a request, the Access-Control-Allow-Origin response header cannot be * and must specify the exact origin. This applies to both:

• Cookie headers (already implemented)
• Authorization headers (now implemented)

Fixes #1832