RPC Server: Basic Authentication doesn't work with CORS

[cschuchardt88]

Describe the bug
You allow CORS on RPC Server, but do not allow "Access-Control-Allow-Credentials" if there is basic auth enabled. You do not follow the specification. In short the browser isn't sending the credentials for the login, cause of CORS is not configured right on RPC server.

neo-modules/src/RpcServer/RpcServer.cs

Line 161 in 99ffc84

context.Response.Headers["Access-Control-Allow-Origin"] = "*";

Also note The CORS specification states that setting origins to "*" (all origins) is invalid if the Access-Control-Allow-Credentials header is present.

To Reproduce
Steps to reproduce the behavior:

1. enable config.json with RpcUser and RpcPass
2. open devtools in an browser
3. type fetch('http://127.0.0.1:20332/?jsonrpc=2.0&id=1&method=getapplicationlog&params=[%220x632158b854f3e9cf132ba20b4aacbd5066bb9c330fe1a53a51d1a38c66fd175a%22]'); in console.

Expected behavior
CORS to work with basic auth enabled.

Platform:

• RPC (HTTP)