Struct Cors

Source

pub struct Cors { /* private fields */ }

Implementations§

Source §

impl Cors

Source

pub fn new() -> Self

Deny everything until told otherwise: no origins, no credentials.

Starting closed means a missing line of configuration fails a request in the browser console, where somebody will see it, rather than opening the API to the world.

Source

pub fn permissive() -> Self

Any origin, any method, any header, no credentials.

Right for a genuinely public API. Wrong for anything that reads a session cookie, because the moment allow_credentials is added this becomes “every site on the internet may act as the logged-in user”.

Source

pub fn from_config(config: &Config) -> Self

Read config/cors.json, with Laravel’s key names.

{
  "paths": ["api/*"],
  "allowed_origins": "${CORS_ALLOWED_ORIGINS:*}",
  "allowed_methods": ["*"],
  "allowed_headers": ["*"],
  "exposed_headers": [],
  "max_age": 0,
  "supports_credentials": false
}

Every list accepts either a JSON array or one comma-separated string, which is what makes it settable from .env: a variable can only hold a string.

Source

pub fn paths<I, S>(self, paths: I) -> Self
where I: IntoIterator<Item = S>, S: Into<String>,

Apply only under these paths, Laravel-style: api/*, sanctum/csrf-cookie.

Source

pub fn allow_origins<I, S>(self, origins: I) -> Self
where I: IntoIterator<Item = S>, S: Into<String>,

Allow these origins. A single * inside a pattern matches one label: https://*.example.com allows https://app.example.com and not https://example.com.evil.net.

Source

pub fn allow_any_origin(self) -> Self

Source

pub fn allow_origin_if( self, allow: impl Fn(&str) -> bool + Send + Sync + 'static, ) -> Self

Decide per origin — for a list that lives in a database, say.

Source

pub fn allow_methods(self, methods: impl IntoIterator<Item = Method>) -> Self

Source

pub fn allow_headers<I, S>(self, headers: I) -> Self
where I: IntoIterator<Item = S>, S: Into<String>,

Source

pub fn expose_headers<I, S>(self, headers: I) -> Self
where I: IntoIterator<Item = S>, S: Into<String>,

Let scripts read these response headers. By default a browser exposes only the handful the specification calls “safelisted” — a custom X-Request-Id or X-RateLimit-Remaining is invisible until listed.

Source