Struct Config 

pub struct Config {
    pub origins: Vec<String>,
    pub origin_matchers: Vec<OriginMatcher>,
    pub methods: Vec<Method>,
    pub headers: Vec<HeaderName>,
    pub allow_credentials: bool,
    pub max_age_secs: Option<u32>,
    pub allow_private_network: bool,
}

Available on crate feature plugins only.

CORS policy configuration settings for cross-origin request handling.

Config defines the Cross-Origin Resource Sharing policy including allowed origins, HTTP methods, headers, credential handling, and preflight cache duration. The configuration determines which cross-origin requests are permitted and what headers are added to responses to enable secure cross-origin communication.

Examples

use tako::plugins::cors::Config;
use http::{Method, HeaderName};

let config = Config {
    origins: vec!["https://app.example.com".to_string()],
    methods: vec![Method::GET, Method::POST],
    headers: vec![HeaderName::from_static("x-api-key")],
    allow_credentials: true,
    max_age_secs: Some(3600),
};

Fields

origins: Vec<String>

Exact origin allow-list (legacy). For wider matching, use Self::origin_matchers.

origin_matchers: Vec<OriginMatcher>

Suffix / regex / custom origin matchers (additive on top of origins).

methods: Vec<Method>

List of allowed HTTP methods for cross-origin requests.

headers: Vec<HeaderName>

List of allowed request headers for cross-origin requests.

allow_credentials: bool

Whether to allow credentials (cookies, authorization headers) in cross-origin requests.

max_age_secs: Option<u32>

Maximum age in seconds for preflight request caching by browsers.

allow_private_network: bool

Send Access-Control-Allow-Private-Network: true in preflight responses when the client signals Access-Control-Request-Private-Network: true. Required for browsers to allow public→private requests post Chrome 104.

Implementations

impl Config

pub fn validate(&self) -> Result<(), CorsConfigError>

Validates the CORS configuration against the Fetch spec’s hard rules.

Returns an error if the configuration would produce a header combination that browsers reject (e.g. Access-Control-Allow-Origin: * together with Access-Control-Allow-Credentials: true).

Trait Implementations

impl Clone for Config

fn clone(&self) -> Config

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Default for Config

fn default() -> Config

Provides permissive default CORS configuration suitable for development.