Struct CorsLayer 

pub struct CorsLayer { /* private fields */ }

A CORS policy. See the module docs.

Implementations

impl CorsLayer

pub fn new() -> Self

A closed policy — no origin allowed yet. Add some with allow_origin / allow_any_origin (and methods/headers/credentials as your API needs). Defaults: methods GET + POST, no extra headers, no credentials, no preflight cache.

pub fn permissive() -> Self

A wide-open policy — any origin, the common verbs (GET/POST/PUT/DELETE/PATCH), any request header, no credentials, a one-day preflight cache. Handy for development; tighten it for production.

pub fn allow_any_origin(self) -> Self

Allow any origin. The response still echoes the concrete Origin, so this composes correctly with allow_credentials.

pub fn allow_origin(self, origin: impl Into<String>) -> Self

Add an allowed origin (exact match, e.g. "https://app.example.com"). Calling this after allow_any_origin narrows back to a list.

pub fn allow_methods(self, methods: impl IntoIterator<Item = Verb>) -> Self

Set the methods advertised in preflight responses (Access-Control-Allow-Methods). Default: GET, POST.

pub fn allow_any_header(self) -> Self

Allow any request header — mirrors Access-Control-Request-Headers.

pub fn allow_headers( self, headers: impl IntoIterator<Item = HeaderName>, ) -> Self

Set the allowed request headers explicitly (Access-Control-Allow-Headers).

pub fn expose_headers( self, headers: impl IntoIterator<Item = HeaderName>, ) -> Self

Response headers JS may read beyond the CORS-safelisted ones (Access-Control-Expose-Headers).

pub fn allow_credentials(self, yes: bool) -> Self

Whether credentialed requests (cookies, HTTP auth) are permitted (Access-Control-Allow-Credentials). When on, the wildcard * token is never sent — the policy always echoes concrete origin/header values, which is what the spec requires.

pub fn max_age(self, age: Duration) -> Self

How long a browser may cache a preflight result (Access-Control-Max-Age).

Trait Implementations

impl Clone for CorsLayer

fn clone(&self) -> CorsLayer

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for CorsLayer

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for CorsLayer

fn default() -> Self

Returns the “default value” for a type.