Struct CorsConfig 

pub struct CorsConfig {
    pub allow_origins: Vec<String>,
    pub allow_all_origins: bool,
    pub credentials: bool,
}

Cross-Origin Resource Sharing (CORS) configuration for an HTTP server.

Controls which origins are allowed to make cross-origin requests, whether credentials are included in responses, and generates appropriate CORS headers.

Instantiated via CorsConfigBuilder to ensure the unsafe credentialed-wildcard combination cannot be represented.

Fields

allow_origins: Vec<String>

List of origins allowed to access the server (may contain "*").

allow_all_origins: bool

Whether all origins ("*") are allowed.

credentials: bool

Whether credentials (Authorization, cookies, etc.) are included in responses.

Implementations

impl CorsConfig

pub fn preflight_response( &self, req_origin: Option<&str>, requested_headers: Option<&str>, allowed_methods: &[Method], ) -> Response<ResponseBody>

Build a CORS preflight response (HTTP 204).

Called for OPTIONS requests. Returns appropriate CORS headers based on the request’s Origin header and this config’s allowed origins.

requested_headers is the incoming preflight’s own Access-Control-Request-Headers value, echoed back verbatim as Access-Control-Allow-Headers — a real cross-origin request is never a “simple request” once it sets a non-safelisted header (content-type: application/json is the common case; none of the three safelisted Content-Type values is JSON), so the browser always preflights it first and blocks the real request outright if the preflight doesn’t confirm the header it’s about to send is allowed. Echoing back exactly what was asked grants nothing broader than the caller already requested. allowed_methods becomes Access-Control-Allow-Methods — the caller passes the same per-path method list it already computes for a plain 405 response, so this never drifts from what the route actually accepts.

pub fn apply_to_response( &self, resp: &mut Response<ResponseBody>, req_origin: Option<&str>, )

Apply CORS headers to a response based on the request’s Origin header.

Called after a handler completes successfully. Mutates the response to add appropriate Access-Control-* headers.

Trait Implementations

impl Clone for CorsConfig

fn clone(&self) -> CorsConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for CorsConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for CorsConfig

impl PartialEq for CorsConfig

fn eq(&self, other: &CorsConfig) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for CorsConfig