The last sentence of the following description in the README does not seem to be strict (when AllowCredentials:true is set).

AllowOriginFunc func (origin string) bool: A custom function to validate the origin. It takes the origin as an argument and returns true if allowed, or false otherwise. If this option is set, the content of AllowedOrigins is ignored.

I wrote the following code:

r := gin.Default()

r.Use(cors.New(cors.Options{
  AllowedOrigins: []string{"*"}, // I also wrote other origins
  AllowCredentials: true,
  AllowOriginFunc: func(origin string) bool { // I thought this function can cover AllowedOrigins
    return true
  },
}))

When I made a request to the server, my browser console reported a cross-domain error:

If I comment out AllowedOrigins: []string{"*"}, there will be no problem.