Struct CorsConfig 

pub struct CorsConfig { /* private fields */ }

Cross-Origin Resource Sharing (CORS) configuration.

Controls which origins, methods, and headers are allowed for cross-origin requests. By default, no origins are allowed.

Defaults

Setting	Default
allow_any_origin	false
allow_credentials	false
allowed_methods	GET, POST, PUT, PATCH, DELETE, OPTIONS, HEAD
allowed_headers	none
expose_headers	none
max_age	none

Security: Credentials and Wildcards

According to the CORS specification (Fetch Standard), when credentials mode is enabled (allow_credentials: true), the following headers cannot use the * wildcard value:

• Access-Control-Allow-Origin (must echo the specific origin)
• Access-Control-Allow-Headers (must list specific headers)
• Access-Control-Allow-Methods (must list specific methods)
• Access-Control-Expose-Headers (must list specific headers)

This implementation enforces this: when allow_credentials(true) is combined with allow_any_origin(), the response echoes back the specific request origin instead of returning *.

Example

use fastapi_core::Cors;

// Secure: specific origin with credentials
let cors = Cors::new()
    .allow_origin("https://myapp.example.com")
    .allow_credentials(true)
    .expose_headers(["X-Request-Id"]);

// Also secure: any origin echoes back specific origin when credentials enabled
// (not recommended - prefer explicit origins for security)
let cors = Cors::new()
    .allow_any_origin()
    .allow_credentials(true);

Trait Implementations

impl Clone for CorsConfig

fn clone(&self) -> CorsConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for CorsConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for CorsConfig

fn default() -> Self

Returns the “default value” for a type.