No way to disable caching of CORS-preflight responses

[jub0bs]

Issue Description

Omitting the Access-Control-Max-Age header from a preflight response leads browsers to cache that response for 5 seconds, whereas including

Access-Control-Max-Age: 0

in a preflight response instructs browsers not to cache that preflight response. However, Echo's CORS middleware ignores that distinction and takes a MaxAge value of 0 as a cue to omit the Access-Control-Max-Age header. Therefore, Echo prevents its users from disabling caching of preflight responses.

Version/commit

v4.10.2