Next line returns 200 as status https://github.com/Kong/kong/blob/c817fada7a514d84f6e0aab7461605c71bf3a841/kong/plugins/cors/handler.lua#L13

Internet says it should return 204:

• https://developer.mozilla.org/en-US/docs/Glossary/Preflight_request
• https://docs.microsoft.com/en-us/aspnet/core/security/cors?view=aspnetcore-3.1#preflight-requests

Internet changed its mind since 2018 https://

**Do you want to request a feature or report a bug?

Feature?

What is the current behavior?
Session object ACLs require both the key and the api_id field of the ACL definition to match.

If they mismatch the API does not throw an error.

What is the expected behavior?

The Gateway API should report the discrepancy to stop the token from being generated.

all of these files are ONLY for test cases.

virtual host options

Would there be any appetite to add a rule that checks for the inclusion of required and optional fields in your API?